Technical Information
- '<Current directory>\CHARMER.exe'
- '<Current directory>\CHARMER.exe' (downloaded from the Internet)
- <Current directory>\dl_charmer.exe
- <Current directory>\ONNWZQRQ_CRNJEUFU.txt
- %TEMP%\~DF4E1D.tmp
- from <Current directory>\dl_charmer.exe to <Current directory>\CHARMER.exe
- 'ch###.bizfxr.com':80
- ch###.bizfxr.com/CHARMER.exe?RN##################
- DNS ASK ch###.bizfxr.com