Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '%APPDATA%\Identities\lsass.exe'
- '%TEMP%\WORDRECOVERY.EXE'
- '<SYSTEM32>\alg.exe'
- %WINDIR%\Explorer.EXE
- iexplore.exe
- firefox.exe
- chrome.exe
- %TEMP%\ms4221.tmp
- %TEMP%\~$Archivo Recuperado.doc
- %TEMP%\WORDRECOVERY.EXE
- %TEMP%\WORDRECOVERY.EXE в %APPDATA%\Identities\lsass.exe
- '14#.#54.154.189':80
- '8.#.8.8':80
- 14#.#54.154.189/re/
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''