Technical Information
- %TEMP%\1b5c.tmp\1bea.tmp\1beb.bat
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\1B5C.tmp\1BEA.tmp\1BEB.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\1B5C.tmp\1BEA.tmp\1BEB.bat <Full path to file>"
- '<SYSTEM32>\net.exe' user user DOOMEDBYQFQ
- '<SYSTEM32>\net1.exe' user user DOOMEDBYQFQ