Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HD_ls.exe' = '<SYSTEM32>\HD_ls.exe'
- %TEMP%\1.dat
- %WINDIR%\hd_.exe
- <Current directory>\hd_<File name>.exe
- %WINDIR%\syswow64\hd_ls.exe
- <Current directory>\hd_<File name>.exe
- 'qq#####3.f08.87yun.club':80
- http://qq#####3.f08.87yun.club/hm.txt
- http://qq#####3.f08.87yun.club/hm.dat
- DNS ASK qq#####3.f08.87yun.club
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '<Current directory>\hd_<File name>.exe'