Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wscjpf gspftwch' = '%WINDIR%\Terms.EXE.exe'
- %ProgramFiles%\apppatch\netsyst96.dll
- %WINDIR%\terms.exe.exe
- '81.##.133.208':80
- '81.##.133.208':2015
- '81.##.133.208':2015
- '%WINDIR%\terms.exe.exe'