Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'arcomstart' = '%APPDATA%\software\sowftware.exe'
- IEXPLORE.EXE
- %APPDATA%\software\sowftware.exe
- 'ra####.duckdns.org':1460
- DNS ASK ra####.duckdns.org
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'