Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rar' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{2BC42D51-FCC2-BE9F-6063-EEB528431C7C}] 'StubPath' = '<Full path to virus>'
- %WINDIR%\Explorer.EXE
- 'hm####2.hopto.org':3460
- DNS ASK hm####2.hopto.org