Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IQoRoRfnYmWW' = '%ALLUSERSPROFILE%\Application Data\IQoRoRfnYmWW.exe'
- Диспетчера задач (Taskmgr)
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '%ALLUSERSPROFILE%\Application Data\IQoRoRfnYmWW.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %ALLUSERSPROFILE%\Application Data\IQoRoRfnYmWW.exe
- %TEMP%\InternetExplorerUpdate.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- из <Полный путь к файлу> в %TEMP%\tmp1.tmp
- 'mo##irm.in':80
- 'se####grotesque.org':80
- http://mo##irm.in/pica1/508-direct
- http://se####grotesque.org/404.php?ty###################################
- DNS ASK mo##irm.in
- DNS ASK se####grotesque.org
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b60.b64.380001'