Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Winserver' = '%APPDATA%\systems.exe'
- %APPDATA%\systems.exe
- from <Full path to file> to %APPDATA%\systems.exe
- '43##.#immobil.xyz':80
- http://43##.#immobil.xyz/play/blista.php
- http://43##.#immobil.xyz/play/core.php
- DNS ASK 43##.#immobil.xyz