Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Sklave' = 'cmd /c "start "Sklave" "%ProgramFiles%\Slaven\csrss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '<LS_APPDATA>\csrss.exe'
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Sklave" /d "cmd /c """start """Sklave""" """%ProgramFiles%\Slaven\csrss.exe"""" /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "Sklave" /tr "'%ProgramFiles%\Slaven\csrss.exe' /startup" /sc MINUTE /f /rl highest
- '<LS_APPDATA>\SLAYER Leecher v0.2.exe'
- %ProgramFiles%\Slaven\csrss.exe
- %APPDATA%\Monitor\Screenshots\05-20-2017\8.57 PM
- <LS_APPDATA>\UJU
- <LS_APPDATA>\SLAYER Leecher v0.2.exe
- <LS_APPDATA>\csrss.exe
- 'pa###bin.com':80
- 'wp#d':80
- 'za#####.bounceme.net':4644
- http://pa###bin.com/raw/TdUnEtwN
- http://11#.#11.111.2/wpad.dat via wp#d
- DNS ASK pa###bin.com
- DNS ASK wp#d
- DNS ASK za#####.bounceme.net
- ClassName: '' WindowName: 'SLAYER Leecher v0.2'
- ClassName: 'Shell_TrayWnd' WindowName: ''