Technical Information
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Services' = '%APPDATA%\Windows Services\Windows Services.exe'
- %APPDATA%\windows services\windows services.exe
- %APPDATA%\windows services\windows services.exe
- 'my####rnalip.com':443
- 'ap#.#pstack.com':80
- http://ap#.#pstack.com/95.211.190.199?ac#############################################################
- 'my####rnalip.com':443
- DNS ASK my####rnalip.com
- DNS ASK ap#.#pstack.com
- DNS ASK wo######-24264.portmap.host
- '%APPDATA%\windows services\windows services.exe'
- '%APPDATA%\windows services\windows services.exe' ' (with hidden window)