Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Ltq] 'ImagePath' = '%TEMP%\Ltq.sys'
- 'Ltq' %TEMP%\Ltq.sys
- %TEMP%\ltq.sys
- %TEMP%\ltq.sys
- from %TEMP%\ltq.sys to %TEMP%\ltq1200833\....\temporaryfile
- 'w7###.####cn-beijing.aliyuncs.com':443
- 'microsoft.com':80
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- 'w7###.####cn-beijing.aliyuncs.com':443
- DNS ASK w7###.####cn-beijing.aliyuncs.com
- DNS ASK microsoft.com