Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gkoUC' = 'C:\\Users\\user\\AppData\\Local\\gkoUCU\\gkoUCUQgM.hta'
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
- %LOCALAPPDATA%\gkoucu\gkouc.exe
- %LOCALAPPDATA%\gkoucu\yuyqo.vbs
- %LOCALAPPDATA%\gkoucu\gkoucuqgm.hta
- '10#.#94.171.108':3361
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'