Technical Information
- [<HKLM>\System\CurrentControlSet\Services\.Net CLR] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\.Net CLR] 'ImagePath' = '<SYSTEM32>\rizpeu.exe'
- %WINDIR%\syswow64\rizpeu.exe
- '58.##1.47.153':6380
- '%WINDIR%\syswow64\rizpeu.exe'