Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: "HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”".