Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Sandy64] 'ImagePath' = '%TEMP%\OlrGvK.sys'
- 'Sandy64' %TEMP%\OlrGvK.sys
- %TEMP%\olrgvk.sys
- %TEMP%\olrgvk.sys
- %TEMP%\olrgvk.sys
- 'ap#.#.taobao.com':80
- http://ap#.#.taobao.com/rest/api3.do?ap##########################
- DNS ASK ap#.#.taobao.com