Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1ea68f5d0867b8298bc4fa0066427846' = '"%TEMP%\dla_marde.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1ea68f5d0867b8298bc4fa0066427846' = '"%TEMP%\dla_marde.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\1ea68f5d0867b8298bc4fa0066427846.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\dla_marde.exe' = '%TEMP%\dla_marde.exe:*:Enabled:dla_marde.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\dla_marde.exe" "dla_marde.exe" ENABLE
- '%TEMP%\dla_marde.exe'
- %TEMP%\dla_marde.exe
- 'sp#####cade.ddns.net':8479
- DNS ASK sp#####cade.ddns.net