Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{450D8FBA-AD25-11D0-98A8-0800361B1175}] 'StubPath' = '<Full path to virus> -setup'
- 'www.54#k.cn':3210
- 'www.52##.org':3210
- DNS ASK www.54#k.cn
- DNS ASK www.52##.org
- '<Private IP address>':1035