Technical Information
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\qknguwgjwj.js"
- %WINDIR%\temp\qknguwgjwj.js
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- DNS ASK av#.com
- DNS ASK bi###fender.com
- DNS ASK es##.com
- DNS ASK sa###usery.com
- DNS ASK oc##.thawte.com