Technical Information
- '<SYSTEM32>\wscript.exe' %TEMP%\Kuh.js
- %TEMP%\kuh.js
- http://dw###.9rn8c3tj.ink/?1/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK dw###.9rn8c3tj.ink
- DNS ASK cl###flare.com
- DNS ASK microsoft.com
- '<SYSTEM32>\cmd.exe' /S /D /c" sEt/p BQWTF="%PSQA:Vbfl=%%S3U8:ISOGZ=/%" 0<nul 1>%TEMP%\Kuh%IPV%s"
- '<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo stArt <SYSTEM32>\wsCript.eXe %TEMP%\Kuh%IPV%s"
- '<SYSTEM32>\cmd.exe'