Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Network Adapter Events] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Network Adapter Events] 'ImagePath' = '<SYSTEM32>\msbzkfwv.exe /service'
- 'Network Adapter Events' <SYSTEM32>\msbzkfwv.exe /service
- %WINDIR%\syswow64\msbzkfwv.exe
- %WINDIR%\syswow64\storage\5dd3e3d7\split.avi
- %WINDIR%\syswow64\storage\5dd3e3d7\archer.avi
- %WINDIR%\syswow64\storage\5dd3e3d7\archer.avi
- 'microsoft.com':80
- DNS ASK microsoft.com
- DNS ASK rg###-oxfcy.org
- '%WINDIR%\syswow64\msbzkfwv.exe' /service