Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8b4948fcf0e8d36277a0356473779464' = '"%TEMP%\24.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '8b4948fcf0e8d36277a0356473779464' = '"%TEMP%\24.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\8b4948fcf0e8d36277a0356473779464.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\24.exe' = '%TEMP%\24.exe:*:Enabled:24.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\24.exe" "24.exe" ENABLE
- '%TEMP%\24.exe'
- %TEMP%\24.exe
- 'localhost':2466