Technical Information
- %WINDIR%\syswow64\wuapp.exe
- 'rd##co.ga':80
- http://rd##co.ga/b/Iewsvjf_Abdhtpxd.png
- DNS ASK rd##co.ga
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '%WINDIR%\syswow64\wuapp.exe'