This interval value is set in the following registry key:  HKCU\Software\Microsoft\HY08A\Policy  Additionally, in the event the C2 response instructs the malware to update C2 URLs, it will be in the following format:  1001; [unique_identifier] [url]  The malware will encrypt the URL string with a 4-byte XOR key of “\x01\x02\x03\x04” and store this data in the following registry key:  HKCU\Software\Microsoft\HY08A\[unique_identifier]  The TDrop2 malware family that was witnessed in a recent attack against a European transportation company provided a minimal set of commands to the attackers.