Technical Information
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = '%WINDIR%\InstallDir\Server.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '%WINDIR%\InstallDir\Server.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{L701K711-VTMF-EB26-S6UL-ML15D731HY8A}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe restart'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{L701K711-VTMF-EB26-S6UL-ML15D731HY8A}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe'
- %WINDIR%\syswow64\svchost.exe
- %TEMP%\server.exe
- %WINDIR%\installdir\server.exe
- 'localhost':81
- DNS ASK bb####.no-ip.org
- ClassName: 'MS_WINHELP' WindowName: ''
- '%TEMP%\server.exe'
- '%WINDIR%\syswow64\svchost.exe'
- '%ProgramFiles(x86)%\opera\launcher.exe'