Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Kwkuoq iaysha] 'ImagePath' = '%ProgramFiles%\wwyx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Kwkuoq iaysha] 'Start' = '00000002'
- '<SYSTEM32>\wscript.exe' "C:\5012.vbs"
- '%ProgramFiles%\wwyx.exe'
- C:\5012.vbs
- %ProgramFiles%\wwyx.exe
- %ProgramFiles%\wwyx.exe
- C:\5012.vbs
- 'bx##.3322.org':2017
- 'bz#.#800.org':2017
- DNS ASK bx##.3322.org
- DNS ASK bz#.#800.org