Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%HOMEPATH%\Documents\RoyalNET\Royal.exe'
- %HOMEPATH%\documents\royalnet\royal.exe
- %APPDATA%\microsoft\wuauclt.exe
- %HOMEPATH%\documents\royalnet\royal.exe
- DNS ASK ma####apo.no-ip.org
- '%HOMEPATH%\documents\royalnet\royal.exe'
- '%APPDATA%\microsoft\wuauclt.exe'