Technical Information
- [HKLM\System\CurrentControlSet\Services\Rsxdgl mhforkmf] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Rsxdgl mhforkmf] 'ImagePath' = '%ProgramFiles(x86)%\Woyuiq.exe'
- 'Rsxdgl mhforkmf' %ProgramFiles(x86)%\Woyuiq.exe
- %TEMP%\scvhost.exe
- %ProgramFiles(x86)%\woyuiq.exe
- %ProgramFiles(x86)%\woyuiq.exe
- from %TEMP%\scvhost.exe to %WINDIR%\syswow64\1240020.bak
- '11#.#80.188.151':666
- '11#.#80.188.151':666
- ClassName: 'CTXOPConntion_Class' WindowName: ''
- '%TEMP%\scvhost.exe'
- '%ProgramFiles(x86)%\woyuiq.exe'
- '%ProgramFiles(x86)%\woyuiq.exe' Win7