Technical Information
- [HKLM\SYSTEM\CurrentControlSet\Services\SysMain] 'Start' = '00000002'
- %WINDIR%\prefetch\pfsvperfstats.bin
- 'cl###trace.pro':443
- 'pl.##oxyfly.pro':443
- 'cl###trace.pro':443
- 'pl.##oxyfly.pro':443
- DNS ASK cl###trace.pro
- DNS ASK pl.##oxyfly.pro
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s SysMain