Technical Information
- %WINDIR%\syswow64\kyhsmj.bat
- %WINDIR%\syswow64\twwuyyvmm.bat
- nul
- %WINDIR%\syswow64\bcvyawrgvm.bat
- from %WINDIR%\syswow64\kyhsmj.bat to %WINDIR%\syswow64\bcvyawrgvm.bat
- DNS ASK ba###com.net.cn
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\twwuyyvmm.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\twwuyyvmm.bat
- '%WINDIR%\syswow64\ping.exe' -n 3 127.0.0.1