Technical Information
- <Current directory>\5473.exe
- %WINDIR%\syswow64\delsexe.vbs
- %WINDIR%\syswow64\delsexe.vbs
- %WINDIR%\syswow64\delsexe.vbs
- http://we#.#ago.club/myCheck/updateInfo.php
- DNS ASK we#.#ago.club
- '<Current directory>\5473.exe' gao
- '%WINDIR%\syswow64\wscript.exe' "<SYSTEM32>\delSexe.vbs"