Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Network Adapter Events] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Network Adapter Events] 'ImagePath' = '<SYSTEM32>\msopaysc.exe /service'
- 'Network Adapter Events' <SYSTEM32>\msopaysc.exe /service
- %WINDIR%\syswow64\msopaysc.exe
- %WINDIR%\syswow64\storage\300837de\correct.avi
- %WINDIR%\syswow64\storage\300837de\delete.avi
- %WINDIR%\syswow64\storage\300837de\join.avi
- %WINDIR%\syswow64\storage\300837de\split.avi
- %WINDIR%\syswow64\storage\300837de\archer.avi
- %WINDIR%\syswow64\storage\300837de\archer.avi
- 'microsoft.com':80
- DNS ASK microsoft.com
- DNS ASK uq####n-uixjwgr.org
- '%WINDIR%\syswow64\msopaysc.exe' /service