Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = 'C:\Users\%USERNAME%-Admin\AppData\Local\Temp\uPDATEr.exe'
- '<SYSTEM32>\svchost.exe'
- <SYSTEM32>\svchost.exe
- %TEMP%\%USERNAME%7
- %TEMP%\%USERNAME%8
- %TEMP%\%USERNAME%2.txt
- %APPDATA%\%USERNAME%log.dat
- %APPDATA%\%USERNAME%log.dat
- <Полный путь к вирусу>
- %TEMP%\%USERNAME%7
- %TEMP%\%USERNAME%8
- %TEMP%\%USERNAME%2.txt
- 'an####os.no-ip.org':1604
- DNS ASK an####os.no-ip.org