Dupzom

MFC42.INI
xiaoji12.top <- c2
12345678
2017 < c2 port observed
9090
13568557371356855737
T190512
Wsaugm quieieug <- startup service name in registry
Hziedb crgavgyqckotipexor <- startup service display name
3124124124214 <- startup service description
%SystemRoot%\
Hllyjag.exe < exe dropped in systemroot
Cqyltc dpewqvkc < mutex
12010
http://www.ip138.com/ips138.asp?ip=%s&action=2
http://dns.aizhan.com/?q=%s
http://user.qzone.qq.com/%s < observed