Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = ''
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\svchost.exe'
- %APPDATA%\sqlite3.dll
- %APPDATA%\svchost.exe
- %TEMP%\log.log
- http://www.sh##ip.com/
- DNS ASK sh##ip.com
- '%APPDATA%\svchost.exe'
- '%APPDATA%\svchost.exe' ' (with hidden window)