Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'a5666c1eebd6f8b5cb4aeb3f7b4eceef' = '"%TEMP%\hold.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'a5666c1eebd6f8b5cb4aeb3f7b4eceef' = '"%TEMP%\hold.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\a5666c1eebd6f8b5cb4aeb3f7b4eceef.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\hold.exe" "hold.exe" ENABLE
- %TEMP%\hold.exe
- 'me###5.ddns.net':1177
- DNS ASK me###5.ddns.net
- '%TEMP%\hold.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\hold.exe" "hold.exe" ENABLE' (with hidden window)