Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{1XD015DQ-JJUA-GP1G-2M0B-7II384121TRH}] 'StubPath' = '"<Full path to file>"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DeComuque' = '<Full path to file>'
- <Current directory>\Settings.ini
- %TEMP%\~DF4EC8.tmp
- <Current directory>\Settings.ini
- 'ko####.punkdns.pw':5700
- DNS ASK ko####.punkdns.pw