Technical Information
- [<HKLM>\System\CurrentControlSet\Services\vccorlib140d] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vccorlib140d] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDHE\vccorlib140d.exe"'
- 'vccorlib140d' "%WINDIR%\SysWOW64\KBDHE\vccorlib140d.exe"
- 'vccorlib140d' %WINDIR%\SysWOW64\KBDHE\vccorlib140d.exe
- from <Full path to file> to %WINDIR%\syswow64\kbdhe\vccorlib140d.exe
- '65.#6.62.20':80
- '20#.#26.6.222':8080
- http://20#.##6.6.222:8080/TxjQOHhq/bKFysM23kX661QJbWVf/yKuEhTTNQxy6xIY2/8cWwlawC6jHToFdSsfa/Zji2xMLl0tLlETd/ via 20#.#26.6.222