Technical Information
- %WINDIR%\syswow64\calc.exe
- http://bl#######ell.ddnsto.com:5000/vJirVpC81exq72vuNDsZuwjspi2Na_j1qQkvXXWOt0JqHsvCIL--yvHbfE3iob1YqO05wQQx7Qas5CNFF6Zm7Ar0lwH_R7h_OtF7PuF5UNTuiKRTSJiM7O8TVV1tVEl5UUXJFgcVDSaf-9ohUnm8rkw1i2oPs...
- DNS ASK bl#####shell.ddnsto.com
- '%WINDIR%\syswow64\calc.exe'