Technical Information
- <Current directory>\tmp.hxml
- <Current directory>\tmp.hxml
- http://19#.#.247.119/sin.png
- '%WINDIR%\syswow64\cmd.exe' PowerShell "Start-Sleep 10; Remove-Item <Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' PowerShell "Start-Sleep 10; Remove-Item <Full path to file>"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Start-Sleep 10; Remove-Item <Full path to file>"