Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eroor' = '<SYSTEM32>\server1\hacked.exe'
- '<SYSTEM32>\server1\hacked.exe'
- <SYSTEM32>\server1\hacked.exe
- 'mo#####d76188.no-ip.biz':81
- 'fr###eoip.net':80
- fr###eoip.net/xml/
- DNS ASK mo#####d76188.no-ip.biz
- DNS ASK fr###eoip.net