Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'eidft' = '%APPDATA%\eidftn\eidftnUJr.url'
- %WINDIR%\syswow64\dllhost.exe
- %APPDATA%\eidftn\eidft.exe
- %APPDATA%\eidftn\eidftnujr.url
- 'an####.duckdns.org':3360
- DNS ASK an####.duckdns.org
- '%WINDIR%\syswow64\dllhost.exe'