Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\server\server.exe'
- %APPDATA%\server\server.exe
- %APPDATA%\user.txt
- http://fr###eoip.net/json/
- http://fr###eoip.net/shutdown
- DNS ASK fr###eoip.net
- DNS ASK in#####0121.ddns.net