Technical Information
- %WINDIR%\syswow64\mstsc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- 'rd##co.ga':80
- http://rd##co.ga/h/Vxabyseq_Vqaoqwef.bmp
- DNS ASK rd##co.ga
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout 2
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '%WINDIR%\syswow64\mstsc.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"