Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CSPlatform' = '%PROGRAM_FILES%\ReXianTV\ReXianTV.exe'
- %WINDIR%\ReXianTV_simplemoudlesTG1_21028.exe /S
- %WINDIR%\ReXianTV_simplemoudlesTG1_21028.exe (downloaded from the Internet)
- %WINDIR%\voipGkGjJDhD.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ReXianTV_simplemoudlesTG1_21028[1].exe
- 'x2.##oooa.cn':80
- 'localhost':1035
- x2.##oooa.cn/ReXianTV_simplemoudlesTG1_21028.exe
- DNS ASK x2.##oooa.cn
- '<Private IP address>':1036