Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'OperaSetups' = '%APPDATA%\RuntimeBroker\RuntimeBroker.exe'
- [<HKCU>\software\Microsoft\Windows\CurrentVersion\Run] 'de8b5941a480a52b8514ae10547ac51a' = '"%APPDATA%\systame.exe" ..'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'de8b5941a480a52b8514ae10547ac51a' = '"%APPDATA%\systame.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\de8b5941a480a52b8514ae10547ac51a.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\systame.exe" "systame.exe" ENABLE
- %APPDATA%\runtimebroker\runtimebroker.exe
- %APPDATA%\systame.exe
- DNS ASK ta####0.zapto.org
- '%APPDATA%\systame.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\systame.exe" "systame.exe" ENABLE' (with hidden window)