Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%APPDATA%\smhost.exe",'
- installutil.exe
- %APPDATA%\smhost.exe
- %TEMP%\installutil.exe
- 'ha###.mine.nu':9998
- DNS ASK ha###.mine.nu
- '%TEMP%\installutil.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\