Technical Information
- [<HKLM>\System\CurrentControlSet\Services\PSEXESVC] 'ImagePath' = '%WINDIR%\PSEXESVC.exe'
- 'PSEXESVC' %WINDIR%\PSEXESVC.exe
- %WINDIR%\syswow64\cmd.exe
- %WINDIR%\syswow64\psexec64.exe
- <SYSTEM32>\psexec64.exe
- %WINDIR%\psexesvc.exe
- unc\hzscdzaroh\pipe\psexesvc
- %WINDIR%\psexesvc.exe
- %WINDIR%\syswow64\psexec64.exe
- <SYSTEM32>\psexec64.exe
- from <Full path to file> to %WINDIR%\temp\ltq1330548\....\temporaryfile
- from <Full path to file> to %WINDIR%\temp\_@52c1.tmp
- <Full path to file>
- from <Full path to file> to %TEMP%\ltq1328676\....\temporaryfile
- '%WINDIR%\syswow64\psexec64.exe' -i -d -s <Full path to file>
- '%WINDIR%\psexesvc.exe'
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\psexec64.exe' -i -d -s <Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe'