Technical Information
- https://85461bc9670e64.lhr.life/script.ps1
- %TEMP%\bd94.tmp\bd95.tmp\bd96.bat
- %TEMP%\bd94.tmp\bd95.tmp\bd96.bat
- '85#####9670e64.lhr.life':443
- '85#####9670e64.lhr.life':443
- DNS ASK 85#####9670e64.lhr.life
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\BD94.tmp\BD95.tmp\BD96.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\BD94.tmp\BD95.tmp\BD96.bat <Full path to file>"