Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Intel' = '%TEMP%\Intel.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Intel] 'ImagePath' = '%TEMP%\Intel.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\Intel] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\hy5.5] 'ImagePath' = '%TEMP%\wTZEvGl.sys'
- '%TEMP%\Intel.exe'
- '%TEMP%\IS.EXE'
- NtOpenProcess, драйвер-обработчик: wTZEvGl.sys
- %TEMP%\Intel.exe
- %TEMP%\Intel.sys
- %TEMP%\wTZEvGl.sys
- %TEMP%\IS.EXE
- %TEMP%\wTZEvGl.sys
- %TEMP%\wTZEvGl.sys
- DNS ASK www.ba##u.com
- ClassName: 'SysIPAddress32' WindowName: ''
- ClassName: 'SysTreeView32' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'SysHeader32' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'SysDateTimePick32' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'ListBox' WindowName: ''
- ClassName: 'msctls_progress32' WindowName: ''
- ClassName: 'msctls_trackbar32' WindowName: ''