Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd569c7c92b009a923c27da44e631fc4b' = '"%APPDATA%\Client.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'd569c7c92b009a923c27da44e631fc4b' = '"%APPDATA%\Client.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\d569c7c92b009a923c27da44e631fc4b.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\Client.exe" "Client.exe" ENABLE
- %APPDATA%\start.bat
- %APPDATA%\21.exe
- %APPDATA%\client.exe
- %APPDATA%\1.ppt
- '<LOCALNET>.1.163':6522
- ClassName: 'EDIT' WindowName: ''
- '%APPDATA%\21.exe' -pfeufh78473873nn -d%APPDATA%
- '%APPDATA%\client.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\Client.exe" "Client.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\start.bat" "
- '%ProgramFiles%\microsoft office\office14\powerpnt.exe' "%APPDATA%\1.ppt"