Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '48F0D2CCEC46' = '%WINDIR%\SysWOW64\jonsen.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'PoJonSe' = '<Full path to file>'
- jonsen.exe
- %WINDIR%\syswow64\jonsen.exe
- <Full path to file>
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui#############
- DNS ASK us###.qzone.qq.com
- '%WINDIR%\syswow64\jonsen.exe'
- '%WINDIR%\syswow64\jonsen.exe' ' (with hidden window)