Technical Information
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'HMKHA_Service' = '<SYSTEM32>\HMKHA.exe'
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
- Windows Recovery Environment (WinRE)
- <SYSTEM32>\hmkha.exe
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\reagentc.exe' /disable' (with hidden window)