Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8dec0097450de10260c5720ec0948eac' = '"%HOMEPATH%\HACKCF.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '8dec0097450de10260c5720ec0948eac' = '"%HOMEPATH%\HACKCF.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\8dec0097450de10260c5720ec0948eac.exe
- <Drive name for removable media>:\8dec0097450de10260c5720ec0948eac.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\HACKCF.exe' = '%HOMEPATH%\HACKCF.exe:*:Enabled:HACKCF.exe'
- '%HOMEPATH%\HACKCF.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\HACKCF.exe" "HACKCF.exe" ENABLE
- %HOMEPATH%\HACKCF.exe
- <Drive name for removable media>:\8dec0097450de10260c5720ec0948eac.exe
- '<L###LNET>.0.2':5552