Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ceaceabcb' = '%APPDATA%\ceaceabcb.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eebbaeeab' = '%APPDATA%\eebbaeeab.exe'
- '%APPDATA%\ceaceabcb.exe'
- '%APPDATA%\eebbaeeab.exe'
- %APPDATA%\ceaceabcb.exe
- %APPDATA%\eebbaeeab.exe
- 'sp###lrc.com':80
- http://sp###lrc.com/wp-content.bak/plugins/js_composer/assets/css/lib/typicons/filesnews/file.php
- DNS ASK sp###lrc.com