Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '493db7064d4b3188b76155c7bf1e9d2b' = '"%TEMP%\BT.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '493db7064d4b3188b76155c7bf1e9d2b' = '"%TEMP%\BT.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\493db7064d4b3188b76155c7bf1e9d2b.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\BT.exe' = '%TEMP%\BT.exe:*:Enabled:BT.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\BT.exe" "BT.exe" ENABLE
- '%TEMP%\BT.exe'
- %TEMP%\BT.exe
- 'ro####482.ddns.net':5552
- DNS ASK ro####482.ddns.net