Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'c6e337341af5f3b35778b752090d0772' = '"%APPDATA%\Fullacces_Cracker.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'c6e337341af5f3b35778b752090d0772' = '"%APPDATA%\Fullacces_Cracker.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\c6e337341af5f3b35778b752090d0772.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\Fullacces_Cracker.exe" "Fullacces_Cracker.exe" ENABLE
- %APPDATA%\fullacces_cracker.exe
- <Full path to file>
- %APPDATA%\fullacces_cracker.exe
- 'ar##ive.org':443
- 'ia#####0.us.archive.org':443
- DNS ASK ar##ive.org
- DNS ASK ia#####0.us.archive.org
- DNS ASK zb###e.ddns.net
- '%APPDATA%\fullacces_cracker.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\Fullacces_Cracker.exe" "Fullacces_Cracker.exe" ENABLE' (with hidden window)