Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bm0g0nue743y6g60ta7qdl1s' = '<SYSTEM32>\jbvunonq.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bm0g0nue743y6g60ta7qdl1s' = '<SYSTEM32>\jbvunonq.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'bm0g0nue743y6g60ta7qdl1s' = '<SYSTEM32>\jbvunonq.exe'
- '<SYSTEM32>\jbvunonq.exe'
- '<SYSTEM32>\attrib.exe' "<Полный путь к вирусу>" -h -r -s
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\9hml1rq5wpcqoy7.bat
- <Полный путь к вирусу>
- <SYSTEM32>\jbvunonq.exe
- <Текущая директория>\9hml1rq5wpcqoy7.bat
- <SYSTEM32>\jbvunonq.exe
- <SYSTEM32>\jbvunonq.exe
- %TEMP%\~DF1A7D.tmp
- %TEMP%\~DF5FF4.tmp
- 'a1###.no-ip.org':9800
- DNS ASK a1###.no-ip.org
- ClassName: '(null)' WindowName: '???? ?? ?? ??'
- ClassName: '(null)' WindowName: '?? ? ?? ?? ??'
- ClassName: '(null)' WindowName: '?????'
- ClassName: '(null)' WindowName: 'Windows ?? ??'
- ClassName: '(null)' WindowName: 'jbvunonq.exe ??'
- ClassName: '(null)' WindowName: 'jbvunonq.exe ?? ??'
- ClassName: '(null)' WindowName: '??? ?? ??? ?? ???'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??? ?? - ??'
- ClassName: '(null)' WindowName: '??? ??'
- ClassName: '(null)' WindowName: '??? ?? ??? ??'