Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ba4c12bee3027d94da5c81db2d196bfd' = '"%TEMP%\svchost.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ba4c12bee3027d94da5c81db2d196bfd' = '"%TEMP%\svchost.exe" ..'
- '%TEMP%\ApnStub.exe' /pid=0xfe0 /log
- '%TEMP%\330.exe'
- '%TEMP%\svchost.exe'
- '<SYSTEM32>\ooVooSetup.exe'
- '<SYSTEM32>\setup.exe'
- '%TEMP%\ApnStub.exe' /tb=OVO2
- '%TEMP%\ApnStub.exe' (загружен из сети Интернет)
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\svchost.exe" "svchost.exe" ENABLE
- %TEMP%\svchost.exe
- %TEMP%\330.exe
- <Служебный элемент>
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba4c12bee3027d94da5c81db2d196bfd.exe
- <SYSTEM32>\setup.exe
- <SYSTEM32>\ooVooSetup.exe
- %TEMP%\ApnStub.exe
- %TEMP%\B099.tmp
- 'm5####555.sytes.net':9999
- 'do#####d.cdn.oovoo.com':80
- 'ww##.oovoo.com':80
- do#####d.cdn.oovoo.com/download/apnstub.exe
- ww##.oovoo.com/DM/DownloadDispatcher.ashx
- ww##.oovoo.com/DM/downloadmanager.ashx
- DNS ASK m5####555.sytes.net
- DNS ASK dn#.##ftncsi.com
- DNS ASK ww##.oovoo.com
- DNS ASK do#####d.cdn.oovoo.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'CicLoaderWndClass' WindowName: ''