Technical Information
- %TEMP%\Happy88_B003_lm279412.exe
- %TEMP%\Happy88_B003_lm279412.exe (downloaded from the Internet)
- %TEMP%\Happy88_B003_lm279412.exe
- 'www.qi###net.com':5678
- 'jh.#1lm.com':80
- jh.#1lm.com/jh/Happy88_B003_lm279412.exe
- DNS ASK www.qi###net.com
- DNS ASK jh.#1lm.com
- '<Private IP address>':1035
- ClassName: 'TWizardForm' WindowName: '???? - Happy88'