Technical Information
- [<HKLM>\System\CurrentControlSet\Services\.Net CLR] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\.Net CLR] 'ImagePath' = '%WINDIR%\qmqmiqs.pif'
- '.Net CLR' %WINDIR%\qmqmiqs.pif
- %WINDIR%\qmqmiqs.pif
- C:\3768.vbs
- C:\3768.vbs
- 'localhost':2014
- '%WINDIR%\qmqmiqs.pif'
- '%WINDIR%\syswow64\wscript.exe' "C:\3768.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\3768.vbs"' (with hidden window)