Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%APPDATA%\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%APPDATA%\svchost.exe'
- '%APPDATA%\svchost.exe'
- '%TEMP%\rundll.exe'
- '%APPDATA%\asz$server.exe'
- svchost.exe
- %TEMP%\rundll.exe
- %APPDATA%\svchost.exe
- %APPDATA%\asz$server.exe
- '21#.#83.58.34':5552
- 'bl####ills.ddns.net':5552
- DNS ASK bl####ills.ddns.net