Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows 10 Update' = '<SYSTEM32>\<File name>.exe'
- %TEMP%\bfsvc.exe
- <SYSTEM32>\tmp_4728
- %TEMP%\bfsvc.exe
- <SYSTEM32>\tmp_4728
- from <Full path to file> to <SYSTEM32>\<File name>.exe
- http://pu#.sh/jMSLc.txt
- DNS ASK pu#.sh
- DNS ASK sm##.live.com