Техническая информация
- '%TEMP%\N6Htv5Nvi7.exe'
- <Текущая директория>\test
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\0[1]
- %TEMP%\N6Htv5Nvi7.exe
- из <Полный путь к вирусу> в %TEMP%\1.tmp
- 'mi###aruda.com':80
- 'localhost':1038
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/info/d77c6556b32bb9c0f647fed33cdd9cf6e12d55c6/check_point9//22004/5.1.2600_Service_Pack_2_32
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/info/d77c6556b32bb9c0f647fed33cdd9cf6e12d55c6/check_point10//22004/5.1.2600_Service_Pack_2_32
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/info/d77c6556b32bb9c0f647fed33cdd9cf6e12d55c6/check_point11//22004/5.1.2600_Service_Pack_2_32
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/startadmin/22004/5.1.2600_Service_Pack_2_32/0/0/0
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/info/d77c6556b32bb9c0f647fed33cdd9cf6e12d55c6/check_point1/C:/bf32d3b0/<Служебное имя>.exe/22004/5.1.2600_Service_Pack_2_32
- mi###aruda.com/da5429b83d9531a3351ac76ff9c625e5/info/d77c6556b32bb9c0f647fed33cdd9cf6e12d55c6/check_point8//22004/5.1.2600_Service_Pack_2_32
- mi###aruda.com/ta.php
- DNS ASK mi###aruda.com