Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cTYpDQkkbPKqlt' = '%ALLUSERSPROFILE%\Application Data\cTYpDQkkbPKqlt.exe'
- Диспетчера задач (Taskmgr)
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '%ALLUSERSPROFILE%\Application Data\cTYpDQkkbPKqlt.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %ALLUSERSPROFILE%\Application Data\cTYpDQkkbPKqlt.exe
- %TEMP%\InternetExplorerUpdate.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- из <Полный путь к файлу> в %TEMP%\tmp1.tmp
- 'mo##irm.in':80
- 'sl##erye.in':80
- http://mo##irm.in/pica1/484-direct
- http://sl##erye.in/404.php?ty##################################
- DNS ASK mo##irm.in
- DNS ASK sl##erye.in
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b88.b8c.380001'