Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Nationaleav] 'Start' = '00000002'
- '<SYSTEM32>\yykeym.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- <SYSTEM32>\yykeym.exe
- 'xl.###arkddos.com':6677
- 'fr####ple.ddns.net':8008
- DNS ASK xl.###arkddos.com
- DNS ASK fr####ple.ddns.net