Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HD_ls.exe' = '<SYSTEM32>\HD_ls.exe'
- %TEMP%\1.dat
- %WINDIR%\hd_.exe
- <Current directory>\hd_<File name>.exe
- %WINDIR%\syswow64\hd_ls.exe
- <Current directory>\hd_<File name>.exe
- DNS ASK qq#####3.f08.87yun.club