Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\svchost] 'Start' = '00000002'
- %WINDIR%\svupdate\svchost.exe
- %WINDIR%\svupdate\sv\svchost.exe
- <SYSTEM32>\sc.exe start svchost
- <SYSTEM32>\sc.exe create svchost binpath= "%WINDIR%\svupdate\sv\svchost.exe" type= own start= auto
- %WINDIR%\svupdate\svchost.exe
- %WINDIR%\svupdate\sv\svchost.exe
- %WINDIR%\svupdate\dns
- 'ip#####erver.no-ip.org':4500
- DNS ASK ip#####erver.no-ip.org
- ClassName: 'Shell_TrayWnd' WindowName: ''