Technical Information
- [<HKCU>\software\microsoft\windows\currentversion\run] 'hwYAAkIA.exe' = '%HOMEPATH%\RooscosU\hwYAAkIA.exe'
- [<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'ooMosEEc.exe' = '%ALLUSERSPROFILE%\jQsUAMAo\ooMosEEc.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\jQsUAMAo\ooMosEEc.exe,'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%ALLUSERSPROFILE%\jQsUAMAo\ooMosEEc.exe,'
- %HOMEPATH%\rooscosu\hwyaakia
- %ALLUSERSPROFILE%\jqsuamao\oomoseec
- %HOMEPATH%\rooscosu\hwyaakia.exe
- %ALLUSERSPROFILE%\jqsuamao\oomoseec.exe
- %WINDIR%\syswow64\config\systemprofile\rooscosu\hwyaakia
- <Current directory>\vike.exe
- <Current directory>\vike.exe
- 'bl##k.io':443
- DNS ASK bl##k.io
- '%HOMEPATH%\rooscosu\hwyaakia.exe'
- '%ALLUSERSPROFILE%\jqsuamao\oomoseec.exe'