Technical Information
- '%WINDIR%\Temp\_ex-08.exe'
- '%WINDIR%\Temp\_ex-68.exe'
- '%WINDIR%\Temp\_ex-08.exe' (downloaded from the Internet)
- '%WINDIR%\Temp\_ex-68.exe' (downloaded from the Internet)
- %WINDIR%\Temp\_ex-08.exe
- %WINDIR%\Temp\_ex-68.exe
- 'aw##bak.eu':80
- 'hy##hez.eu':80
- http://aw##bak.eu/jucheck.exe
- http://hy##hez.eu/relqw23.exe
- DNS ASK aw##bak.eu
- DNS ASK hy##hez.eu