Technical Information
- [HKLM\System\CurrentControlSet\Services\Stuvwx] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Stuvwx] 'ImagePath' = '%WINDIR%\rizpiu.exe'
- 'Stuvwx' %WINDIR%\rizpiu.exe
- %WINDIR%\rizpiu.exe
- from <Full path to file> to %WINDIR%\syswow64\1166091.bak
- '45.##7.13.59':8001
- DNS ASK ba##u.com
- '%WINDIR%\rizpiu.exe'
- '%WINDIR%\rizpiu.exe' Win7