Technical Information
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\hhheader.wpfwq.jse"
- %ALLUSERSPROFILE%\hhheader.wpf
- unc\llbljup*\mailslot\net\netlogon
- from %ALLUSERSPROFILE%\hhheader.wpf to %ALLUSERSPROFILE%\hhheader.wpfwq.jse
- '18#.#83.96.173':443
- 'bb#.com':443
- DNS ASK bb#.com