Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\server\server.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'x32d33295' = '%HOMEPATH%\x32d33295\62421.vbs'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
- '%HOMEPATH%\x32d33295\mwSkSshvb.exe' XDRcjBuEm.KJW
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- %HOMEPATH%\x32d33295\62421.vbs
- %HOMEPATH%\x32d33295\99929.cmd
- %APPDATA%\%USERNAME%.txt
- %APPDATA%\server\server.exe
- %HOMEPATH%\x32d33295\mwSkSshvb.exe
- %HOMEPATH%\x32d33295\uBwobWkTd.KYO
- %HOMEPATH%\x32d33295\hiSIwqpcuN.QQZ
- %HOMEPATH%\x32d33295\XDRcjBuEm.KJW
- %HOMEPATH%\x32d33295\hiSIwqpcuN.QQZ
- %HOMEPATH%\x32d33295\62421.vbs
- %HOMEPATH%\x32d33295\99929.cmd
- %HOMEPATH%\x32d33295\uBwobWkTd.KYO
- %HOMEPATH%\x32d33295\mwSkSshvb.exe
- %HOMEPATH%\x32d33295\XDRcjBuEm.KJW
- 'jo#####l2010.no-ip.biz':2020
- 'fr###eoip.net':80
- 'wp#d':80
- http://fr###eoip.net/json/
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK jo#####l2010.no-ip.biz
- DNS ASK fr###eoip.net
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''