Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\HQNVZH.lnk
- %TEMP%\aut1.tmp
- %TEMP%\ybpmnph
- %TEMP%\Skyp\svchost.exe
- %TEMP%\aut1.tmp
- %TEMP%\ybpmnph
- 'ip###ore.com':80
- 'ne#.####th-carereform.com':81
- http://ip###ore.com/checkip/
- DNS ASK ip###ore.com
- DNS ASK ne#.####th-carereform.com