Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Winhost' = '%APPDATA%\winserv.exe'
- %APPDATA%\winserv.exe
- from <Full path to file> to %APPDATA%\winserv.exe
- '43##.#immobil.xyz':80
- http://43##.#immobil.xyz/play/blista.php
- http://43##.#immobil.xyz/play/core.php
- DNS ASK 43##.#immobil.xyz