Technical Information
- [<HKLM>\SOFTWARE\Classes\Drive\shell\open\command] '' = '<Full path to virus> "%1"'
- <Full path to virus>T2.exe
- <Full path to virus>T2.exe (downloaded from the Internet)
- <Full path to virus>T2.exe
- <SYSTEM32>\8u1mk8w7.dll
- <Full path to virus>T2.exe
- 'x1.##i265.com':80
- x1.##i265.com/DownURL/RegSerSetup.exe
- DNS ASK X1.##i265.com
- '<Private IP address>':1038
- ClassName: 'MS_WINHELP' WindowName: ''