Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Mauivy' = '<SYSTEM32>\shimengm.exe'
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\shimengm.exe'
- '<SYSTEM32>\ipconfig.exe' /flushdns
- %TEMP%\~unins1250.bat
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- <SYSTEM32>\shimengm.exe
- %HOMEPATH%xplore.exe
- <SYSTEM32>\shimengm.exe
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- 'im###hut4.cn':80
- 'mi####christ.com':80
- http://im###hut4.cn/update/utu.dat
- http://mi####christ.com/html/license_43EC922A3D0E1F403834ED436BA8085A686E606DF596C71B1F47B22D93555C332C0C0719D7D5C142B8C2C3E65DCC50966E34BA8C4D56463B02F3FED9544A9D2924CF3F64589D6F1F39EE27D4E973...
- DNS ASK im###hut4.cn
- DNS ASK mi####christ.com
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bf4.bf8.390001'