Technical Information
- %APPDATA%\bit6a85.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %APPDATA%\bit6a85.tmp
- from %APPDATA%\bit6a85.tmp to %APPDATA%\kalkulationskolonnernes.pla
- '14#.#8.103.250':80
- http://14#.#8.103.250/universalstrmforsyninger.snp
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "<#Houve overlapningen Datalogidels Splining Torotoro Exoterics #>;<#Kaalhoved Complicitous Sdfyldte Boniterings Recessivt #>;New-Item -Path 'Cephalobranchiata:\Udnytters' -Name 'Rerecord114' -...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "<#Houve overlapningen Datalogidels Splining Torotoro Exoterics #>;<#Kaalhoved Complicitous Sdfyldte Boniterings Recessivt #>;New-Item -Path 'Cephalobranchiata:\Udnytters' -Name 'Rerecord114' -...
- '<SYSTEM32>\cmd.exe' /c "echo 1 && exit"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "<#Houve overlapningen Datalogidels Splining Torotoro Exoterics #>;<#Kaalhoved Complicitous Sdfyldte Boniterings Recessivt #>;New-Item -Path 'Cephalobranchiata:\Udnytters' -Name 'Rerecord114' -...
- '%WINDIR%\syswow64\cmd.exe' /c "echo 1 && exit"