Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
- '<SYSTEM32>\conhost.exe'
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_045480a4\Report.wer
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- <Полный путь к вирусу>
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- '31.##0.153.253':80
- 'localhost':49197
- 'localhost':49200
- 'localhost':49203
- '31.#2.73.29':80
- 'localhost':49191
- '10#.86.69.3':80
- '17#.#82.70.33':80
- '93.##.57.117':80
- 'localhost':49194
- '46.##9.200.17':80
- 'localhost':49212
- 'localhost':49215
- '15#.#24.138.59':80
- '46.##0.19.74':80
- 'localhost':49206
- '46.##9.225.4':80
- '31.##2.220.15':80
- '94.##3.44.72':80
- 'localhost':49209
- 'localhost':49188
- 'localhost':49167
- '10#.#29.173.130':80
- '68.#9.87.0':80
- '15#.0.38.33':80
- 'localhost':49170
- '10#.#00.253.153':80
- 'localhost':49158
- 'localhost':49161
- 'localhost':49164
- '46.##2.212.40':80
- 'localhost':49182
- '93.##.167.124':80
- '17#.#51.244.1':80
- '18#.#90.42.32':80
- 'localhost':49185
- '17#.#51.115.1':80
- 'localhost':49173
- 'localhost':49176
- 'localhost':49179
- '31.##.162.34':80
- 15#.#24.138.59/search.htm
- DNS ASK dn#.##ftncsi.com
- DNS ASK go.###rosoft.com
- DNS ASK wa####.microsoft.com
- '22#.0.0.252':5355