Technical Information
- %WINDIR%\syswow64\uwcxnd.bat
- %WINDIR%\syswow64\taynqvbmw.bat
- nul
- %WINDIR%\syswow64\yqucrypuds.bat
- from %WINDIR%\syswow64\uwcxnd.bat to %WINDIR%\syswow64\yqucrypuds.bat
- DNS ASK ba###com.net.cn
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\taynqvbmw.bat
- '%WINDIR%\syswow64\ping.exe' -n 3 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\taynqvbmw.bat' (with hidden window)