Technical Information
- '%TEMP%\tmp2.exe'
- '%TEMP%\tmp1.exe'
- '%TEMP%\tmp2.exe' (downloaded from the Internet)
- '%TEMP%\tmp1.exe' (downloaded from the Internet)
- %TEMP%\tmp2.exe
- %TEMP%\tmp1.exe
- 'cl.ly':80
- 'wp#d':80
- cl.ly/0w2W0x3z1d3R073W3C2u/f1.exe
- cl.ly/1M2t0s0a1L2316313U1w/f.exe
- wp#d/wpad.dat
- DNS ASK cl.ly
- DNS ASK wp#d