Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\] '1806' = '00000000'
- %TEMP%\ywb..bat
- http://my###ibird.com/hebalaif.php?in##############################################################################################################
- DNS ASK si##.com.cn
- DNS ASK wo###ress.com
- DNS ASK fo####upezio.net
- DNS ASK my###ibird.com
- DNS ASK di##put.net
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Ywb..bat" > nul 2> nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Ywb..bat" > nul 2> nul