Technical Information
- %WINDIR%\explorer.exe
- <SYSTEM32>\cmd.exe
- %TEMP%\ce46.tmp\ce47.tmp\ce58.bat
- %ALLUSERSPROFILE%\microsoft_rwgyxq\check.exe
- %ALLUSERSPROFILE%\microsoft_fxxaah\check.exe
- %TEMP%\ce46.tmp\ce47.tmp\ce58.bat
- 'na####ngzi.dns.army':5501
- http://na######zi.dns.army:5501/rKWPIg##/I8PVoN7FTe2C2IPZ51G8oQ0Aa7O_pWiNajSgXFWV1FX_vFo10sSWVdXWruEfc-S2yl764uXQxGapfoAWB-OqoyGFq_m5-BxmUCsd4UoDzhKKmZ0ljvcn_IEElcshBkL via na####ngzi.dns.army
- http://na######zi.dns.army:5501/rKWPIg##/I8PVoN7FTe2C2IPZ51LqMgTCZrIm8rj2wDdWBBCnagq42rMFXyAN4ybWc/ via na####ngzi.dns.army
- DNS ASK na####ngzi.dns.army
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CE46.tmp\CE47.tmp\CE58.bat <Full path to file>"
- '%WINDIR%\syswow64\explorer.exe'