Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'XXXXXX9759ACD3' = '%WINDIR%\XXXXXX9759ACD3\svchsot.exe'
- %WINDIR%\syswow64\9759acd3
- from <Full path to file> to %WINDIR%\xxxxxx9759acd3\svchsot.exe
- '10#.#7.89.152':30533
- ClassName: '' WindowName: 'ÈðÐdzÌÐòÉý¼¶ÖÐ'