Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\system32.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\system32.URL
- %HOMEPATH%\Start Menu\Programs\Startup\system32.js
- %HOMEPATH%\Start Menu\Programs\Startup\system32.exe
- %HOMEPATH%\Start Menu\Programs\Startup\system32.vbs
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
- %TEMP%\vbc1.tmp
- %TEMP%\zamii5l4.out
- %TEMP%\RES3.tmp
- %TEMP%\vbc2.tmp
- <SYSTEM32>\system32.exe
- %TEMP%\CZwfRtNH.txt
- %TEMP%\zamii5l4.cmdline
- %TEMP%\zamii5l4.0.vb
- <SYSTEM32>\system32.exe
- <Full path to file>
- %HOMEPATH%\Start Menu\Programs\Startup\system32.exe
- '73.##0.103.114':4748
- '<LOCALNET>.55.104':4748
- '<SYSTEM32>\system32.exe'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3.tmp" "%TEMP%\vbc2.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\zamii5l4.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'