Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Management Instrumentation' = '"%APPDATA%\Microsoft\wuosao.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\armhost] 'Start' = '00000002'
- '%APPDATA%\Microsoft\wuosao.exe'
- '<SYSTEM32>\doasue.exe'
- '%TEMP%\wexikmrb.k2l.exe'
- '%TEMP%\opvsgjyf.zzo.exe'
- <SYSTEM32>\doasue.InstallLog
- <Текущая директория>\InstallUtil.InstallLog
- %APPDATA%\Microsoft\Development\data.zip
- <SYSTEM32>\doasue.InstallState
- <SYSTEM32>\doasue.exe
- %TEMP%\opvsgjyf.zzo.exe
- %TEMP%\wexikmrb.k2l.exe
- <LS_APPDATA>\win32libs.sys
- %APPDATA%\Microsoft\wuosao.exe
- %APPDATA%\Microsoft\Development\data.zip
- <SYSTEM32>\doasue.InstallState
- <SYSTEM32>\doasue.InstallLog
- '3d####3c836a.biz':80
- 'wp#d':80
- 3d####3c836a.biz/grep/index.php?ra####
- 3d####3c836a.biz/grep/x32.zip
- wp#d/wpad.dat
- DNS ASK 3d####3c836a.biz
- DNS ASK wp#d
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'