Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Hijklm Opqrstuv Xya] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Hijklm Opqrstuv Xya] 'ImagePath' = '<SYSTEM32>\aeouew.exe'
- 'Hijklm Opqrstuv Xya' <SYSTEM32>\aeouew.exe
- %WINDIR%\syswow64\aeouew.exe
- 'ww#2.cn':6380
- DNS ASK ww#2.cn
- '%WINDIR%\syswow64\aeouew.exe'