Technical Information
- '' (downloaded from the Internet)
- %TEMP%\dKjn.zip
- %TEMP%\zFlSMhLN.exe
- '14#.#6.180.164':80
- http://14#.#6.180.164/klono.rtf
- http://14#.#6.180.164/ovo.jpg
- '%TEMP%\zFlSMhLN.exe' x dKjn.zip -pvim123456 -y
- '<SYSTEM32>\cmd.exe' /k c: & cd\ & cd %HOMEPATH%\Local Settings\Temp & zFlSMhLN.exe x dKjn.zip -pvim123456 -y & exit