Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GlitchInstrumentation' = 'C:\MSOCache\Ron.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GlitchInstrumentation' = 'C:\MSOCache\Ron.exe'
- 'C:\MSOCache\Hen.exe'
- 'C:\MSOCache\Ron.exe'
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v GlitchInstrumentation /d "C:\MSOCache\Ron.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Service Pack /d "C:\MSOCache\Hen.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v GlitchInstrumentation /d "C:\MSOCache\Ron.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Service Pack /d "C:\MSOCache\Hen.exe" /f
- '<SYSTEM32>\cmd.exe' /c ""C:\MSOCache\start1.bat" "
- '<SYSTEM32>\wscript.exe' "C:\MSOCache\test.vbs"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL C:\MSOCache\1.pdf
- '<SYSTEM32>\cmd.exe' /c ""C:\MSOCache\start.bat" "
- C:\MSOCache\test.vbs
- C:\MSOCache\Ron.exe
- C:\MSOCache\Info-2013-04-21.log
- C:\MSOCache\start1.bat
- C:\MSOCache\1.pdf
- C:\MSOCache\Hen.exe
- C:\MSOCache\start.bat
- 'ku####-panda.info':80
- DNS ASK ku####-panda.info
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''