Technical Information
- '<SYSTEM32>\net.exe' stop bits
- %WINDIR%\Temp\1.vbs
- %WINDIR%\Temp\c.exe
- %WINDIR%\Temp\d.exe
- %WINDIR%\Temp\AutoItX3.dll
- %WINDIR%\Temp\CnCalendar.ocx
- %WINDIR%\Temp\cyldll.dll
- ClassName: 'EDIT' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%WINDIR%\temp\1.vbs"
- '<SYSTEM32>\cmd.exe' /c sc config bits start= disabled
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\cmd.exe' /c net stop bits
- '<SYSTEM32>\net1.exe' stop bits