Technical Information
- '%TEMP%\rad4c936.tmp'
- %TEMP%\rad4c936.tmp
- http://it##ug.org/wp-content/ai1wm-backups/doc/2c.jpg
- http://fo###desabz.com/wp-content/themes/Avada/languages/2c.jpg
- DNS ASK it##ug.org
- DNS ASK fo###desabz.com
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad4C936.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad4C936.tmp