Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\hoxgqtwwju.js
- %APPDATA%\hoxgqtwwju.js
- 'ja####torun.duia.ro':5465
- 'br#####ian.duckdns.org':7974
- DNS ASK br#####ian.duckdns.org
- DNS ASK ja####torun.duia.ro
- '<SYSTEM32>\wscript.exe' //B "%APPDATA%\HoXGqtwWjU.js"