Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'kissq' = '%HOMEPATH%\AppData\'
- %TEMP%\jfiag_gg.exe
- %TEMP%\fjgha23_fa.txt
- %TEMP%\kissq.exe
- http://ip##pi.com/json/
- http://hf####2.2ihsfa.com/api/fbtime
- DNS ASK ip##pi.com
- DNS ASK hf####2.2ihsfa.com
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt' (with hidden window)