Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{0A49925E-ADE0-F390-7E58-B4436A316DAF}] 'StubPath' = '<SYSTEM32>\syspols.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\syspols.exe
- 'my##.#rabdance.com':8080
- DNS ASK my##.#rabdance.com