Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\6to4] 'Start' = '00000002'
- '%TEMP%\subfile.exe'
- '%TEMP%\<Virus name>.exe'
- %TEMP%\277156.gho
- %TEMP%\subfile.exe
- %TEMP%\<Virus name>.exe
- <SYSTEM32>\config\SysEvent.Evt
- %TEMP%\subfile.exe
- <SYSTEM32>\config\AppEvent.Evt
- <SYSTEM32>\config\SecEvent.Evt
- from %TEMP%\277156.gho to <SYSTEM32>\nt6to4.dll
- 'ch####ng1.f3322.org':42421
- 'ch####ng1.f3322.org':42420
- 'ch####ng1.f3322.org':42419
- DNS ASK ch####ng1.f3322.org
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'