Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{KR33R81-QW6Q-MUZ9-IT34-DVHOBLX4UM61}' = '"%APPDATA%\amd64_microsoft.virtualiz..ent.rdpclientaxhost_31bf3856ad364e35_10.0.17134.345_none_...
- %APPDATA%\amd64_microsoft.virtualiz..ent.rdpclientaxhost_31bf3856ad364e35_10.0.17134.345_none_88eb0f84cbab8ff0\ole2nls.exe
- from <Full path to file> to %APPDATA%\amd64_microsoft.virtualiz..ent.rdpclientaxhost_31bf3856ad364e35_10.0.17134.345_none_88eb0f84cbab8ff0\ole2nls.exe
- 'ip###ger.org':443
- DNS ASK ip###ger.org
- '%APPDATA%\amd64_microsoft.virtualiz..ent.rdpclientaxhost_31bf3856ad364e35_10.0.17134.345_none_88eb0f84cbab8ff0\ole2nls.exe'