Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Logon WMI Installer WinHTTP Internet Locator' = 'C:\eyypmhbsldue\hqgrhbqxxnj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Controls Block Card Name Store] 'ImagePath' = 'C:\eyypmhbsldue\hqgrhbqxxnj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Controls Block Card Name Store] 'Start' = '00000002'
- 'C:\eyypmhbsldue\ljzirshzagnk.exe' "c:\eyypmhbsldue\hqgrhbqxxnj.exe"
- 'C:\eyypmhbsldue\hqgrhbqxxnj.exe'
- 'C:\eyypmhbsldue\l3i30w5ezyqzibpom.exe'
- C:\eyypmhbsldue\hqgrhbqxxnj.exe
- C:\eyypmhbsldue\ljzirshzagnk.exe
- C:\eyypmhbsldue\ylxhpekp7zu
- %WINDIR%\eyypmhbsldue\mzjntl38yn
- C:\eyypmhbsldue\mzjntl38yn
- C:\eyypmhbsldue\l3i30w5ezyqzibpom.exe
- C:\eyypmhbsldue\ljzirshzagnk.exe
- C:\eyypmhbsldue\hqgrhbqxxnj.exe
- C:\eyypmhbsldue\l3i30w5ezyqzibpom.exe
- %WINDIR%\eyypmhbsldue\mzjntl38yn
- '37.##2.223.103':22969
- '84.##8.130.85':27132
- '86.##5.19.130':27743
- '80.#4.199.6':49579
- '77.##7.13.68':30018
- '18#.#49.88.79':32097
- '11#.#42.143.147':31567
- '21#.#19.80.21':36542
- ClassName: 'Shell_TrayWnd' WindowName: ''