Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ff0bf16dbd2fc1fa145a0547628e85cb' = '"%TEMP%\hackpool8.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ff0bf16dbd2fc1fa145a0547628e85cb' = '"%TEMP%\hackpool8.exe" ..'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\hackpool8.exe' = '%TEMP%\hackpool8.exe:*:Enabled:hackpool8.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\hackpool8.exe" "hackpool8.exe" ENABLE
- '%TEMP%\hackpool8.exe'
- %TEMP%\hackpool8.exe
- 'ha######ali2001jr.no-ip.biz':4444
- DNS ASK ha######ali2001jr.no-ip.biz