Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'psthost' = '<SYSTEM32>\psthost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\rddwa] 'ImagePath' = '<SYSTEM32>\regfns.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DLSProvider] 'ImagePath' = '<SYSTEM32>\dls.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DLSProvider] 'Start' = '00000002'
- <SYSTEM32>\libeay32.dll
- '<SYSTEM32>\snrm.exe'
- '<SYSTEM32>\cmd.exe' /c "sc create rddwa binPath= "<SYSTEM32>\regfns.exe" type= own & net start rddwa & sc delete rddwa"
- '<SYSTEM32>\sc.exe' create rddwa binPath= "<SYSTEM32>\regfns.exe" type= own
- '<SYSTEM32>\psthost.exe' -i
- '<SYSTEM32>\dls.exe'
- '<SYSTEM32>\javarnupd.exe'
- '<SYSTEM32>\regsvr32.exe' /s wseng.dll
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39748f43-69b1-4c59-9a35-f9643ee949d1}']
- [<HKLM>\SOFTWARE\Classes\CLSID\{39748f43-69b1-4c59-9a35-f9643ee949d1}\InprocServer32] '' = '<SYSTEM32>\wseng.dll'
- <SYSTEM32>\zlib1.dll
- <SYSTEM32>\ssleay32.dll
- <SYSTEM32>\msvcr90.dll
- <SYSTEM32>\regfns.exe
- <SYSTEM32>\snrm.exe
- <SYSTEM32>\psthost.exe
- <SYSTEM32>\wseng.dll
- <SYSTEM32>\javarnupd.exe
- <SYSTEM32>\dls.exe
- <SYSTEM32>\msvcp90.dll
- <SYSTEM32>\libcurl.dll
- <SYSTEM32>\atl90.dll
- <SYSTEM32>\snrm.exe
- <SYSTEM32>\javarnupd.exe