Technical Information
- '<SYSTEM32>\regsvr32.exe' ..\xwnlm.ocx
- <Current directory>\a7231000
- <PATH_SAMPLE>.xls
- 'ke#####onstruction.com':80
- http://ke#####onstruction.com/_vti_bin/DFNorq/
- DNS ASK ke#####onstruction.com
- '<SYSTEM32>\regsvr32.exe' ..\xwnlm.ocx' (with hidden window)