Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HD_ls.exe' = '<SYSTEM32>\HD_ls.exe'
- %HOMEPATH%\desktop\calc.exe
- %HOMEPATH%\desktop\skypesetup.exe
- %HOMEPATH%\desktop\utorrent.exe
- %TEMP%\1.dat
- %WINDIR%\hd_.exe
- <Current directory>\hd_<File name>.exe
- %TEMP%\1.ico
- %TEMP%\rcxd316.tmp
- %TEMP%\rcxd421.tmp
- %TEMP%\rcxd4ec.tmp
- %WINDIR%\syswow64\hd_ls.exe
- <Current directory>\hd_<File name>.exe
- %TEMP%\1.ico
- from %TEMP%\rcxd316.tmp to %TEMP%\1.dat
- from %TEMP%\rcxd421.tmp to %TEMP%\1.dat
- from %TEMP%\rcxd4ec.tmp to %TEMP%\1.dat
- %TEMP%\jusched.log
- %TEMP%\1.ico
- 'ja#######d-secure.oracle.com':443
- 'qq#####3.f08.87yun.club':80
- 'microsoft.com':80
- http://qq#####3.f08.87yun.club/hm.txt
- http://qq#####3.f08.87yun.club/hm.dat
- 'ja#######d-secure.oracle.com':443
- DNS ASK ja#######d-secure.oracle.com
- DNS ASK qq#####3.f08.87yun.club
- DNS ASK microsoft.com
- '<Current directory>\hd_<File name>.exe'