Technical Information
- %TEMP%\cf0e.tmp
- %TEMP%\cf1f.tmp
- %TEMP%\d615.tmp.js
- '19#.#23.246.227':80
- '<SYSTEM32>\wscript.exe' "%TEMP%\D615.tmp.js" 1081277027
- '<SYSTEM32>\cmd.exe' /c del /F /Q "<Full path to file>' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /F /Q "<Full path to file>