Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\irmon] 'Start' = '00000002'
- <SYSTEM32>\helpsvc.dat
- <SYSTEM32>\helpsvc.dll
- 'ms####ver.ddns.us':1863
- '11#.#0.183.141':443
- 'ms####ver.ddns.us':443
- 'he##.##crosoftmse.com':443
- 'he##.##crosoftmse.com':1863
- DNS ASK ms####ver.ddns.us
- DNS ASK he##.##crosoftmse.com