Technical Information
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sihost' = '%APPDATA%\sihost.exe'
- '<SYSTEM32>\know.exe'
- <SYSTEM32>\know.exe
- %APPDATA%\sihost.exe
- 'ip##pi.com':80
- '19#.#8.218.126':40252
- 'su#####me.gl.at.ply.gg':40252
- http://ip##pi.com/line/?fi############
- DNS ASK ip##pi.com
- DNS ASK su#####me.gl.at.ply.gg