Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CR87p8G7' = '<Full path to file>'
- %WINDIR%\syswow64\comp.exe
- %WINDIR%\8000
- <Full path to file>
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui###################
- DNS ASK us###.qzone.qq.com
- DNS ASK ms###csi.com
- 'localhost':64066
- 'localhost':56693
- '%WINDIR%\syswow64\comp.exe' ' (with hidden window)
- '%WINDIR%\syswow64\comp.exe'