Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'progra.exe' = '%CommonProgramFiles%\progra.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\svtm.exe] 'Start' = '00000002'
- '<SYSTEM32>\progra.exe'
- <SYSTEM32>\progra.exe
- from <SYSTEM32>\progra.exe to %CommonProgramFiles%\progra.exe
- from <Full path to virus> to %CommonProgramFiles%\progra.exe
- 'as####g.f3322.org':1986
- DNS ASK as####g.f3322.org