Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winupdate' = 'rundll32 ""<LS_APPDATA>\winnew.dll"",run2'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 ""%TEMP%\IXP000.TMP\""'
- <SYSTEM32>\rundll32.exe cp2.dll,run
- <SYSTEM32>\ntvdm.exe -f -i2
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\rundll32.exe teste2.dll,run2
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %TEMP%\IXP000.TMP\cp2.dll
- %TEMP%\IXP000.TMP\teste2.dll
- %TEMP%\IXP000.TMP\run.bat
- %TEMP%\IXP000.TMP\run.bat
- %TEMP%\IXP000.TMP\teste2.dll
- %TEMP%\IXP000.TMP\cp2.dll
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- 'www.la###a.com.br':80
- www.la###a.com.br/add.php
- DNS ASK www.la###a.com.br
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b6c.b70.3b0001'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b0c.b10.3a0001'