Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\019e657cb22a4adff87cde41464df865.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\smrs.exe' = '%TEMP%\smrs.exe:*:Enabled:smrs.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\smrs.exe" "smrs.exe" ENABLE
- %TEMP%\smrs.exe
- 'ag####6.ddns.net':1177
- DNS ASK ag####6.ddns.net
- '%TEMP%\smrs.exe'