Technical Information
- '<SYSTEM32>\wbem\wmic.exe' process call create "cmstp /ns /s /su %APPDATA%\Microsoft\11768.inf"
- %APPDATA%\microsoft\11768.inf
- http://xm#.##relour.com/visit.txt
- DNS ASK xm#.##relour.com
- '<SYSTEM32>\cmstp.exe' /ns /s /su %APPDATA%\Microsoft\11768.inf