Technical Information
- [<HKLM>\System\CurrentControlSet\Services\xactengine3_2] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xactengine3_2] 'ImagePath' = '"%WINDIR%\SysWOW64\htui\xactengine3_2.exe"'
- 'xactengine3_2' "%WINDIR%\SysWOW64\htui\xactengine3_2.exe"
- 'xactengine3_2' %WINDIR%\SysWOW64\htui\xactengine3_2.exe
- from <Full path to file> to %WINDIR%\syswow64\htui\xactengine3_2.exe
- '20#.#16.145.225':443
- '96.##6.101.6':8080
- '5.###.108.185':8080
- '16#.#14.153.111':8080
- http://20#.##6.145.225:443/sGOtLI/eO2HY3pCL8GsxhD/bycbM2ViUF2IEvLH4W/jMxEChfp/HnBrFkYTCn4Jb/ via 20#.#16.145.225
- http://5.###.108.185:8080/JRgswy6aXcmOIKl/B0VnsPerd1xmOeII8p2/ via 5.###.108.185
- http://16#.###.153.111:8080/lvwHywBMnfS/QeVVw7/ via 16#.#14.153.111