Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender 2012' = '<SYSTEM32>\qyvdggmv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender 2012' = '<SYSTEM32>\qyvdggmv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Windows Defender 2012' = '<SYSTEM32>\qyvdggmv.exe'
- <SYSTEM32>\qyvdggmv.exe
- <SYSTEM32>\attrib.exe "<Полный путь к вирусу>" -h -r -s
- <SYSTEM32>\cmd.exe /c <Текущая директория>\2w2khsxvb98cc2m.bat
- <Полный путь к вирусу>
- <SYSTEM32>\qyvdggmv.exe
- <Текущая директория>\2w2khsxvb98cc2m.bat
- <SYSTEM32>\qyvdggmv.exe
- <SYSTEM32>\qyvdggmv.exe
- %TEMP%\~DF2649.tmp
- %TEMP%\~DF75E1.tmp
- 'localhost':1038
- 'so###55.oa.to':83
- 'localhost':1035
- '1.###.38.153':8080
- DNS ASK so###55.oa.to
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''