Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Layer Now IKE Web Log Process TCP/IP Fax' = '<SYSTEM32>\ayuigabw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Copy Connection WLAN Interface] 'Start' = '00000002'
- Центр обеспечения безопасности (Security Center)
- '%WINDIR%\Temp\y7aavcp56vvvor.exe' -r 25317 tcp
- '%WINDIR%\Temp\y7aavcp5kqzvor.exe' -r 23512 tcp
- '<SYSTEM32>\vxftbjvibs.exe' "<SYSTEM32>\ayuigabw.exe"
- '%TEMP%\y7aavcp4l7xvorhodwseac.exe'
- '<SYSTEM32>\ayuigabw.exe'
- <SYSTEM32>\wvjwumunicroxi\run
- <SYSTEM32>\wvjwumunicroxi\rng
- <SYSTEM32>\wvjwumunicroxi\cfg
- %WINDIR%\Temp\y7aavcp5kqzvor.exe
- %WINDIR%\Temp\y7aavcp56vvvor.exe
- %TEMP%\y7aavcp4l7xvorhodwseac.exe
- <SYSTEM32>\wvjwumunicroxi\tst
- <SYSTEM32>\wvjwumunicroxi\etc
- <SYSTEM32>\vxftbjvibs.exe
- <SYSTEM32>\ayuigabw.exe
- <SYSTEM32>\vxftbjvibs.exe
- <SYSTEM32>\ayuigabw.exe
- %WINDIR%\Temp\y7aavcp56vvvor.exe
- %WINDIR%\Temp\y7aavcp5kqzvor.exe
- %TEMP%\y7aavcp4l7xvorhodwseac.exe
- <DRIVERS>\etc\hosts
- 'si###rmy.net':80
- si###rmy.net/index.php?me#########################################
- DNS ASK sa###econd.net
- DNS ASK wi###new.net
- DNS ASK so###blood.net
- DNS ASK si###rmy.net
- '23#.#55.255.250':1900