Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = '%TEMP%\skoop\skyp.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '%TEMP%\skoop\skyp.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{627NWKLJ-K2TL-ADHK-N5H2-723CDI52X6A0}] 'StubPath' = '%TEMP%\skoop\skyp.exe restart'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{627NWKLJ-K2TL-ADHK-N5H2-723CDI52X6A0}] 'StubPath' = '%TEMP%\skoop\skyp.exe'
- %WINDIR%\syswow64\svchost.exe
- %TEMP%\skoop\skyp.exe
- '82.##2.208.20':2020
- '%WINDIR%\syswow64\svchost.exe'