Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\] '1806' = '00000000'
- %TEMP%\twain001.mtx
- %TEMP%\wwf..bat
- DNS ASK st###leupon.com
- DNS ASK hu####gtonpost.com
- DNS ASK ta###plus.in
- DNS ASK kw##ium.in
- DNS ASK sk###oonline.in
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Wwf..bat" > nul 2> nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Wwf..bat" > nul 2> nul