Technical Information
- %WINDIR%\syswow64\notepad.exe
- nul
- http://cs####.c2er.me:443/QNCz via cs###m.c2er.me
- DNS ASK cs###m.c2er.me
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 1000