Technical Information
- http://91.##5.155.102/v66fyr as %appdata%\myphoto_(passwd_123
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %ProgramFiles(x86)%\company\newproduct\12.txt
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- '91.##5.155.102':80
- http://91.##5.155.102/v66FYr
- '%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\MyPhoto_(PASSWD_123).rar