Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'google update' = '<Full path to virus>'
- '%TEMP%\clr.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\clr.bat""
- %TEMP%\clr.bat
- %TEMP%\clr.exe
- %TEMP%\clr.txt
- 'no######n2.markaz-royal.net':8686
- DNS ASK no######n2.markaz-royal.net
- ClassName: 'Indicator' WindowName: '(null)'