Technical Information
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Images' = '%ALLUSERSPROFILE%\cdimages.exe'
- cdimages.exe
- %ALLUSERSPROFILE%\cdimages.exe
- 'bh#####ive55.ydns.eu':5210
- DNS ASK bh#####ive55.ydns.eu
- '%ALLUSERSPROFILE%\cdimages.exe'