Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'daydaybuy' = '<Full path to file> restart'
- <Current directory>\copy<File name>.exe
- <Current directory>\copy<File name>.exe
- http://www.bo##.com/recommend/liveRoom?m=######################
- http://im##.##che.netease.com/bobo/img19/1901notice/notice08.css
- DNS ASK sa##jy.com
- DNS ASK bo##.com
- DNS ASK jc.##0160.com
- DNS ASK im##.##che.netease.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- '<Current directory>\copy<File name>.exe' <Current directory>\copy<File name>.exe
- '<Current directory>\copy<File name>.exe' <Current directory>\copy<File name>.exe' (with hidden window)