Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wsmigt jksizbku' = '%ProgramFiles(x86)%\Ljhnlye.exe'
- %ProgramFiles(x86)%\ljhnlye.exe
- 'le####an.f3322.net':1998
- 'le####an.f3322.net':1998
- DNS ASK le####an.f3322.net
- '%ProgramFiles(x86)%\ljhnlye.exe'