Technical Information
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'SMTP Monitor' = '%ProgramFiles(x86)%\SMTP Monitor\smtpmon.exe'
- %APPDATA%\8cf7b530-613e-439b-a8c5-ccfc0e745400\run.dat
- %ProgramFiles(x86)%\smtp monitor\smtpmon.exe
- '67.##5.154.243':49761