Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Wflokk qamwaa' = '%CommonProgramFiles%\Rvwacks.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Wflokk qamwaa] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Wflokk qamwaa] 'ImagePath' = '%CommonProgramFiles%\Rvwacks.exe'
- %CommonProgramFiles%\Rvwacks.exe
- C:\7500.vbs
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\1611554701[1]
- <Full path to file>
- C:\7500.vbs
- 'dd##.520qq.xyz':8000
- 'localhost':1041
- 'us##.#zone.qq.com':80
- http://us##.#zone.qq.com/1611554701
- DNS ASK dd##.520qq.xyz
- DNS ASK us##.#zone.qq.com
- '%CommonProgramFiles%\Rvwacks.exe'
- '<SYSTEM32>\wscript.exe' "C:\7500.vbs"