Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Stuvwx] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Stuvwx] 'ImagePath' = '%WINDIR%\svchost.exe'
- %WINDIR%\svchost.exe
- from <Full path to file> to <SYSTEM32>\152515.bak
- 'qq######802.b1.luyouxia.net':40325
- DNS ASK qq######802.b1.luyouxia.net
- '%WINDIR%\svchost.exe'