Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'syotom' = '%WINDIR%\SysWOW64\cmd.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] '6Mjd4XA2' = '<Full path to file>'
- %WINDIR%\syswow64\cmd.exe
- %TEMP%\d41d8cd98f00b204e9800998ecf8427e.zip
- <Full path to file>
- 'us###.qzone.qq.com':80
- 'eo####kfk.gnway.org':99
- DNS ASK us###.qzone.qq.com
- DNS ASK eo####kfk.gnway.org
- DNS ASK teredo.ipv6.microsoft.com
- 'localhost':59879
- 'localhost':58931
- 'localhost':61011
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe'