Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender Anti-Virus' = '%APPDATA%\wmvszakluzymn.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender Anti-Virus' = '%APPDATA%\wmvszakluzymn.exe'
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\upqfsakluqqep.URL
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\dllcache\ctfmon.exe with <SYSTEM32>\dllcache\ctfmon.exe.new
- <SYSTEM32>\ctfmon.exe with <SYSTEM32>\ctfmon.exe.new
- %APPDATA%\wmvszakluzymn.exe <Full path to virus>
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\alg.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\smss.exe
- <SYSTEM32>\ctfmon.exe
- %TEMP%\spekzjozdq
- <SYSTEM32>\ctfmon.acp
- %APPDATA%\wmvszakluzymn.exe
- '91.##1.66.32':80
- 91.##1.66.32/dbg3.php?ch#########