Technical Information
- %WINDIR%\explorer.exe
- firefox.exe
- iexplore.exe process, wininet.dll module
- %WINDIR%\syswow64\autofmt.exe
- 'cd#.##scordapp.com':443
- 'cd#.##scordapp.com':443
- DNS ASK cd#.##scordapp.com
- '%WINDIR%\syswow64\cmd.exe' /c timeout 10' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;
- '%WINDIR%\syswow64\cmd.exe' /c timeout 10
- '%WINDIR%\syswow64\timeout.exe' 10
- '%WINDIR%\syswow64\wlanext.exe'
- '%WINDIR%\syswow64\cmd.exe' del "<Full path to file>"