Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'zbvpdeylbgueqdlh' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\xhaepfvzkesrljsxf.DLL"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'zbvpdeylbgueqdlh' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\xhaepfvzkesrljsxf.dll"'
- %TEMP%\nshaffe.tmp
- %TEMP%\nsxb00f.tmp\system.dll
- %TEMP%\xhaepfvzkesrljsxf.dll
- %WINDIR%\syswow64\xhufplaenejokht.exe
- %TEMP%\nsxb00f.tmp\system.dll
- from %TEMP%\xhaepfvzkesrljsxf.dll to %WINDIR%\syswow64\xhaepfvzkesrljsxf.dll
- DNS ASK ad#.#ooochi.biz
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\xhaepfvzkesrljsxf.dll"