Technical Information
- '<SYSTEM32>\wscript.exe' %TEMP%\8jo.js
- %TEMP%\8jo.js
- http://0r####.l13hjhebfkzz.net/?1/
- DNS ASK 0r####.l13hjhebfkzz.net
- '<SYSTEM32>\cmd.exe' /S /D /c" sEt/p R86AW="%ZESH:JzHr=%%KLUW:CXKVA=/%" 0<nul 1>%TEMP%\8jo%YBT%s"
- '<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo stArt <SYSTEM32>\wsCript.eXe %TEMP%\8jo%YBT%s"
- '<SYSTEM32>\cmd.exe'