Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\--] 'ImagePath' = '<Full path to file> /wl 1'
- %TEMP%\nsf5.tmp\brh.dat
- %TEMP%\nsf5.tmp\md5dll.dll
- %TEMP%\nsf5.tmp\System.dll
- %TEMP%\nsf5.tmp\ns7.tmp
- %TEMP%\nsf5.tmp\ns6.tmp
- %TEMP%\nsf5.tmp\nsExec.dll
- %TEMP%\nsn2.tmp\zHfeqLJnOlf.dll
- %TEMP%\nsn2.tmp\FwDWfnLukBu.dll
- %TEMP%\nsn2.tmp\WUhbFRx.bmp
- %TEMP%\nsz4.tmp
- %TEMP%\nsn2.tmp\ChjZlWfABDt.dll
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\zHfeqLJnOlf.dll
- %TEMP%\nsf5.tmp\ns6.tmp
- %TEMP%\nsn2.tmp\WUhbFRx.bmp
- %TEMP%\nsn2.tmp\FwDWfnLukBu.dll
- %TEMP%\nsn2.tmp\System.dll
- '%TEMP%\nsf5.tmp\ns7.tmp' net start --
- '%TEMP%\nsf5.tmp\ns6.tmp' sc create -- binPath= ""<Full path to file>" /wl 1"
- '<SYSTEM32>\net1.exe' start --
- '<SYSTEM32>\net.exe' start --
- '<SYSTEM32>\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"