Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{G2IXBBE-CQ7X-I7XY-2Y6F-QXKCZ326RYAG}' = '"%APPDATA%\amd64_microsoft-windows-msmq-runtime-core_31bf3856ad364e35_6.1.7601.17514_none_b3877...
- %APPDATA%\amd64_microsoft-windows-msmq-runtime-core_31bf3856ad364e35_6.1.7601.17514_none_b3877e30cfa2ad0c\ocsetapi.exe
- from <Full path to file> to %APPDATA%\amd64_microsoft-windows-msmq-runtime-core_31bf3856ad364e35_6.1.7601.17514_none_b3877e30cfa2ad0c\ocsetapi.exe
- 'yi#.su':443
- DNS ASK yi#.su
- '%APPDATA%\amd64_microsoft-windows-msmq-runtime-core_31bf3856ad364e35_6.1.7601.17514_none_b3877e30cfa2ad0c\ocsetapi.exe'