Technical Information
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 %tmp%\license.txt,IEX AC
- %TEMP%\license.txt
- %TEMP%\wca9a.tmp
- %TEMP%\license.txt
- 'ww##.0zz0.com':443
- 'ww##.0zz0.com':443
- DNS ASK ww##.0zz0.com
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 %tmp%\license.txt,IEX AC' (with hidden window)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\license.txt,IEX AC
- '<SYSTEM32>\rundll32.exe' %TEMP%\license.txt,IEX AC