Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'krllqn' = '<SYSTEM32>\lsasrvm.exe'
- '<SYSTEM32>\lsasrvm.exe'
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\ipconfig.exe' /flushdns
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\~unins7093.bat
- <SYSTEM32>\lsasrvm.exe
- %HOMEPATH%xplore.exe
- <SYSTEM32>\lsasrvm.exe
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- 'im###hut4.cn':80
- 'mo###inc.net':80
- http://im###hut4.cn/update/utu.dat
- http://mo###inc.net/html/license_43EC922A3D0E1F403834ED406BA80F5A686E606DF596C71B1F47B22D93555C332C0C0719D7D5C142B8C2C3E65DCC50966E34BA8C4D56463B02F3FED9544A9D2924CF3F64589D6F1C6DBF74DFE9738A47...
- DNS ASK im###hut4.cn
- DNS ASK mo###inc.net
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bf8.bfc.390001'