Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'
Заражает следующие исполняемые файлы:
- C:\Far2\Far.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c "<Текущая директория>\<Имя файла>"
- '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
- '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
- '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\gOEYMkgs\XAcW.exe
- %HOMEPATH%\gOEYMkgs\xgsi.exe
- %HOMEPATH%\gOEYMkgs\voMw.exe
- %HOMEPATH%\gOEYMkgs\hQUC.exe
- %HOMEPATH%\gOEYMkgs\BMUe.exe
- %HOMEPATH%\gOEYMkgs\cogy.exe
- %HOMEPATH%\gOEYMkgs\LwYY.exe
- %HOMEPATH%\gOEYMkgs\Ccou.exe
- %HOMEPATH%\gOEYMkgs\IUwI.exe
- %HOMEPATH%\gOEYMkgs\ngIy.exe
- %HOMEPATH%\gOEYMkgs\uUAO.exe
- %HOMEPATH%\gOEYMkgs\Oosy.exe
- %HOMEPATH%\gOEYMkgs\DMoE.exe
- %HOMEPATH%\gOEYMkgs\VkUM.exe
- %HOMEPATH%\gOEYMkgs\rowK.exe
- %HOMEPATH%\gOEYMkgs\zAwQ.exe
- %HOMEPATH%\gOEYMkgs\vYco.exe
- %HOMEPATH%\gOEYMkgs\KAwY.exe
- %HOMEPATH%\gOEYMkgs\wIgI.exe
- %HOMEPATH%\gOEYMkgs\cEQA.exe
- %HOMEPATH%\gOEYMkgs\aUks.exe
- %HOMEPATH%\gOEYMkgs\qAEq.exe
- %HOMEPATH%\gOEYMkgs\zcsO.exe
- %HOMEPATH%\gOEYMkgs\ysEa.exe
- %HOMEPATH%\gOEYMkgs\JAse.exe
- %HOMEPATH%\gOEYMkgs\FsUe.exe
- %HOMEPATH%\gOEYMkgs\OAgs.exe
- %HOMEPATH%\gOEYMkgs\Toce.exe
- %TEMP%\WER4692.dir00\manifest.txt
- %TEMP%\WER4692.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\Xssc.exe
- %HOMEPATH%\gOEYMkgs\jkEY.exe
- %HOMEPATH%\gOEYMkgs\ekki.exe
- %HOMEPATH%\gOEYMkgs\AggW.exe
- %HOMEPATH%\gOEYMkgs\jEsW.exe
- %HOMEPATH%\gOEYMkgs\gsYW.exe
- %HOMEPATH%\gOEYMkgs\VIEQ.exe
- %HOMEPATH%\gOEYMkgs\wQEG.exe
- %HOMEPATH%\gOEYMkgs\NUgY.exe
- %HOMEPATH%\gOEYMkgs\aAkg.exe
- %HOMEPATH%\gOEYMkgs\ZIMI.exe
- %HOMEPATH%\gOEYMkgs\zcIc.exe
- %HOMEPATH%\gOEYMkgs\lgwa.exe
- %HOMEPATH%\gOEYMkgs\PYAg.exe
- %HOMEPATH%\gOEYMkgs\sMcY.exe
- %HOMEPATH%\gOEYMkgs\uIcC.exe
- %HOMEPATH%\gOEYMkgs\dcga.exe
- %HOMEPATH%\gOEYMkgs\sQcs.exe
- %HOMEPATH%\gOEYMkgs\AYIi.exe
- %HOMEPATH%\gOEYMkgs\zAsM.exe
- %HOMEPATH%\gOEYMkgs\bosG.exe
- %HOMEPATH%\gOEYMkgs\CUwW.exe
- %HOMEPATH%\gOEYMkgs\AEwG.exe
- %HOMEPATH%\gOEYMkgs\FcYi.exe
- %TEMP%\WERbd8e.dir00\manifest.txt
- %TEMP%\WERbd8e.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\ggos.exe
- %HOMEPATH%\gOEYMkgs\zYUw.exe
- %HOMEPATH%\gOEYMkgs\XIAA.exe
- %HOMEPATH%\gOEYMkgs\IwQk.exe
- %HOMEPATH%\gOEYMkgs\kMQW.exe
- %HOMEPATH%\gOEYMkgs\ZgkE.exe
- %HOMEPATH%\gOEYMkgs\JEUW.exe
- %HOMEPATH%\gOEYMkgs\IwYE.exe
- %HOMEPATH%\gOEYMkgs\xIAS.exe
- %HOMEPATH%\gOEYMkgs\Pgsu.exe
- %HOMEPATH%\gOEYMkgs\mUMU.exe
- %HOMEPATH%\gOEYMkgs\MkAc.exe
- %HOMEPATH%\gOEYMkgs\WMoy.exe
- %HOMEPATH%\gOEYMkgs\lwwq.exe
- %HOMEPATH%\gOEYMkgs\dYAI.exe
- %HOMEPATH%\gOEYMkgs\aQsa.exe
- %HOMEPATH%\gOEYMkgs\oEYS.exe
- %HOMEPATH%\gOEYMkgs\UoIg.exe
- %HOMEPATH%\gOEYMkgs\KgMu.exe
- %HOMEPATH%\gOEYMkgs\LwcW.exe
- %HOMEPATH%\gOEYMkgs\YUIm.exe
- %HOMEPATH%\gOEYMkgs\fUom.exe
- %HOMEPATH%\gOEYMkgs\Pcoc.exe
- %HOMEPATH%\gOEYMkgs\OAsY.exe
- %HOMEPATH%\gOEYMkgs\DYYY.exe
- %HOMEPATH%\gOEYMkgs\dYws.exe
- %TEMP%\WERbd8e.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WERbd8e.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\bYUs.exe
- %HOMEPATH%\gOEYMkgs\fcgQ.exe
- %HOMEPATH%\gOEYMkgs\RsEG.exe
- %HOMEPATH%\gOEYMkgs\QQYY.exe
- %HOMEPATH%\gOEYMkgs\osoO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %HOMEPATH%\gOEYMkgs\sssi.exe
- %HOMEPATH%\gOEYMkgs\ZEwk.exe
- %HOMEPATH%\gOEYMkgs\wQwo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %HOMEPATH%\gOEYMkgs\vscE.exe
- %HOMEPATH%\gOEYMkgs\kgAq.exe
- %HOMEPATH%\gOEYMkgs\UUEE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %HOMEPATH%\gOEYMkgs\zAsW.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- <Текущая директория>\<Имя файла>
- %HOMEPATH%\gOEYMkgs\IQgq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %HOMEPATH%\gOEYMkgs\bEcy.exe
- %HOMEPATH%\gOEYMkgs\jAMq.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %HOMEPATH%\gOEYMkgs\PQkK.exe
- %TEMP%\WER5182.dir00\ZgMYMIIE.exe.hdmp
- %TEMP%\WER5182.dir00\ZgMYMIIE.exe.mdmp
- %TEMP%\WER5182.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\aUgs.exe
- %TEMP%\WER5182.dir00\manifest.txt
- %ALLUSERSPROFILE%\caQc.txt
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ
- %HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
- %ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
- %ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
- %HOMEPATH%\gOEYMkgs\rAUm.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %HOMEPATH%\gOEYMkgs\iYAS.exe
- %HOMEPATH%\gOEYMkgs\tggc.exe
- %HOMEPATH%\gOEYMkgs\vcMo.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %HOMEPATH%\gOEYMkgs\OUIs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- %HOMEPATH%\gOEYMkgs\kEoM.exe
- %HOMEPATH%\gOEYMkgs\vYEg.exe
- %HOMEPATH%\gOEYMkgs\fIEM.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
- %HOMEPATH%\gOEYMkgs\gcQk.exe
- %HOMEPATH%\gOEYMkgs\fAoy.exe
- %HOMEPATH%\gOEYMkgs\LgAg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %HOMEPATH%\gOEYMkgs\yckI.exe
- %HOMEPATH%\gOEYMkgs\qUEg.exe
- %TEMP%\WER4692.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\gkUa.exe
- %HOMEPATH%\gOEYMkgs\dYIw.exe
- %TEMP%\WER4692.dir00\ZgMYMIIE.exe.mdmp
- %HOMEPATH%\gOEYMkgs\rMUo.exe
- %HOMEPATH%\gOEYMkgs\uEoQ.exe
- %HOMEPATH%\gOEYMkgs\BIoi.exe
- %HOMEPATH%\gOEYMkgs\HMMg.exe
- %HOMEPATH%\gOEYMkgs\bUUE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %TEMP%\WERcbad.dir00\manifest.txt
- %HOMEPATH%\gOEYMkgs\lYYw.exe
- %HOMEPATH%\gOEYMkgs\oMwE.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %TEMP%\WERcbad.dir00\appcompat.txt
- %HOMEPATH%\gOEYMkgs\JkwI.exe
- %TEMP%\WERcbad.dir00\ZgMYMIIE.exe.mdmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %HOMEPATH%\gOEYMkgs\tkcC.exe
- %TEMP%\WERcbad.dir00\ZgMYMIIE.exe.hdmp
- %HOMEPATH%\gOEYMkgs\PEEO.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
- %HOMEPATH%\gOEYMkgs\zQwu.exe
- %HOMEPATH%\gOEYMkgs\QkEs.exe
- %HOMEPATH%\gOEYMkgs\Jgcs.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %HOMEPATH%\gOEYMkgs\RkYw.exe
Удаляет следующие файлы:
- %HOMEPATH%\gOEYMkgs\zAwQ.exe
- %HOMEPATH%\gOEYMkgs\rowK.exe
- %HOMEPATH%\gOEYMkgs\sMcY.exe
- %HOMEPATH%\gOEYMkgs\VkUM.exe
- %HOMEPATH%\gOEYMkgs\vYco.exe
- %HOMEPATH%\gOEYMkgs\DMoE.exe
- %HOMEPATH%\gOEYMkgs\Oosy.exe
- %HOMEPATH%\gOEYMkgs\KgMu.exe
- %HOMEPATH%\gOEYMkgs\oEYS.exe
- %HOMEPATH%\gOEYMkgs\WMoy.exe
- %HOMEPATH%\gOEYMkgs\MkAc.exe
- %HOMEPATH%\gOEYMkgs\YUIm.exe
- %HOMEPATH%\gOEYMkgs\UoIg.exe
- %HOMEPATH%\gOEYMkgs\LwcW.exe
- %HOMEPATH%\gOEYMkgs\fUom.exe
- %HOMEPATH%\gOEYMkgs\aUks.exe
- %HOMEPATH%\gOEYMkgs\ngIy.exe
- %HOMEPATH%\gOEYMkgs\cogy.exe
- %HOMEPATH%\gOEYMkgs\xgsi.exe
- %HOMEPATH%\gOEYMkgs\uUAO.exe
- %HOMEPATH%\gOEYMkgs\Ccou.exe
- %HOMEPATH%\gOEYMkgs\LwYY.exe
- %HOMEPATH%\gOEYMkgs\IUwI.exe
- %HOMEPATH%\gOEYMkgs\XAcW.exe
- %HOMEPATH%\gOEYMkgs\KAwY.exe
- %HOMEPATH%\gOEYMkgs\cEQA.exe
- %HOMEPATH%\gOEYMkgs\qAEq.exe
- %HOMEPATH%\gOEYMkgs\wIgI.exe
- %HOMEPATH%\gOEYMkgs\voMw.exe
- %HOMEPATH%\gOEYMkgs\BMUe.exe
- %HOMEPATH%\gOEYMkgs\hQUC.exe
- %HOMEPATH%\gOEYMkgs\AYIi.exe
- %HOMEPATH%\gOEYMkgs\IwYE.exe
- %HOMEPATH%\gOEYMkgs\JEUW.exe
- %HOMEPATH%\gOEYMkgs\zAsM.exe
- %HOMEPATH%\gOEYMkgs\dcga.exe
- %HOMEPATH%\gOEYMkgs\uIcC.exe
- %HOMEPATH%\gOEYMkgs\sQcs.exe
- %HOMEPATH%\gOEYMkgs\xIAS.exe
- %HOMEPATH%\gOEYMkgs\ggos.exe
- %HOMEPATH%\gOEYMkgs\XIAA.exe
- %HOMEPATH%\gOEYMkgs\kMQW.exe
- %HOMEPATH%\gOEYMkgs\zYUw.exe
- %HOMEPATH%\gOEYMkgs\mUMU.exe
- %HOMEPATH%\gOEYMkgs\Pgsu.exe
- %HOMEPATH%\gOEYMkgs\ZgkE.exe
- %HOMEPATH%\gOEYMkgs\bosG.exe
- %HOMEPATH%\gOEYMkgs\bYUs.exe
- %HOMEPATH%\gOEYMkgs\RsEG.exe
- %HOMEPATH%\gOEYMkgs\osoO.exe
- %HOMEPATH%\gOEYMkgs\fcgQ.exe
- %HOMEPATH%\gOEYMkgs\lwwq.exe
- %HOMEPATH%\gOEYMkgs\aQsa.exe
- %HOMEPATH%\gOEYMkgs\dYAI.exe
- %HOMEPATH%\gOEYMkgs\QQYY.exe
- %HOMEPATH%\gOEYMkgs\AEwG.exe
- %HOMEPATH%\gOEYMkgs\CUwW.exe
- %HOMEPATH%\gOEYMkgs\FcYi.exe
- %HOMEPATH%\gOEYMkgs\dYws.exe
- %HOMEPATH%\gOEYMkgs\OAsY.exe
- %HOMEPATH%\gOEYMkgs\Pcoc.exe
- %HOMEPATH%\gOEYMkgs\DYYY.exe
- %HOMEPATH%\gOEYMkgs\lYYw.exe
- %HOMEPATH%\gOEYMkgs\oMwE.exe
- %HOMEPATH%\gOEYMkgs\Jgcs.exe
- %HOMEPATH%\gOEYMkgs\tkcC.exe
- %HOMEPATH%\gOEYMkgs\zAsW.exe
- %HOMEPATH%\gOEYMkgs\IQgq.exe
- %HOMEPATH%\gOEYMkgs\JkwI.exe
- %HOMEPATH%\gOEYMkgs\RkYw.exe
- %HOMEPATH%\gOEYMkgs\fAoy.exe
- %HOMEPATH%\gOEYMkgs\LgAg.exe
- %HOMEPATH%\gOEYMkgs\kEoM.exe
- %HOMEPATH%\gOEYMkgs\gcQk.exe
- %HOMEPATH%\gOEYMkgs\QkEs.exe
- %HOMEPATH%\gOEYMkgs\PEEO.exe
- %HOMEPATH%\gOEYMkgs\zQwu.exe
- %TEMP%\FWAwwgsg.bat
- %HOMEPATH%\gOEYMkgs\rAUm.exe
- %HOMEPATH%\gOEYMkgs\iYAS.exe
- %HOMEPATH%\gOEYMkgs\vscE.exe
- %HOMEPATH%\gOEYMkgs\tggc.exe
- %HOMEPATH%\gOEYMkgs\aUgs.exe
- %HOMEPATH%\gOEYMkgs\vcMo.exe
- %HOMEPATH%\gOEYMkgs\OUIs.exe
- %HOMEPATH%\gOEYMkgs\kgAq.exe
- %HOMEPATH%\gOEYMkgs\jAMq.exe
- %HOMEPATH%\gOEYMkgs\PQkK.exe
- %HOMEPATH%\gOEYMkgs\bEcy.exe
- %HOMEPATH%\gOEYMkgs\wQwo.exe
- %HOMEPATH%\gOEYMkgs\UUEE.exe
- %HOMEPATH%\gOEYMkgs\sssi.exe
- %HOMEPATH%\gOEYMkgs\ZEwk.exe
- %HOMEPATH%\gOEYMkgs\ZIMI.exe
- %HOMEPATH%\gOEYMkgs\aAkg.exe
- %HOMEPATH%\gOEYMkgs\zcIc.exe
- %HOMEPATH%\gOEYMkgs\FsUe.exe
- %HOMEPATH%\gOEYMkgs\zcsO.exe
- %HOMEPATH%\gOEYMkgs\JAse.exe
- %HOMEPATH%\gOEYMkgs\OAgs.exe
- %HOMEPATH%\gOEYMkgs\PYAg.exe
- %HOMEPATH%\gOEYMkgs\gsYW.exe
- %HOMEPATH%\gOEYMkgs\wQEG.exe
- %HOMEPATH%\gOEYMkgs\VIEQ.exe
- %HOMEPATH%\gOEYMkgs\AggW.exe
- %HOMEPATH%\gOEYMkgs\lgwa.exe
- %HOMEPATH%\gOEYMkgs\NUgY.exe
- %HOMEPATH%\gOEYMkgs\jEsW.exe
- %HOMEPATH%\gOEYMkgs\ysEa.exe
- %HOMEPATH%\gOEYMkgs\BIoi.exe
- %HOMEPATH%\gOEYMkgs\bUUE.exe
- %HOMEPATH%\gOEYMkgs\HMMg.exe
- %HOMEPATH%\gOEYMkgs\rMUo.exe
- %HOMEPATH%\gOEYMkgs\vYEg.exe
- %HOMEPATH%\gOEYMkgs\fIEM.exe
- %HOMEPATH%\gOEYMkgs\uEoQ.exe
- %HOMEPATH%\gOEYMkgs\qUEg.exe
- %HOMEPATH%\gOEYMkgs\ekki.exe
- %HOMEPATH%\gOEYMkgs\jkEY.exe
- %HOMEPATH%\gOEYMkgs\Toce.exe
- %HOMEPATH%\gOEYMkgs\Xssc.exe
- %HOMEPATH%\gOEYMkgs\yckI.exe
- %HOMEPATH%\gOEYMkgs\dYIw.exe
- %HOMEPATH%\gOEYMkgs\gkUa.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- http:/// via 74.##5.232.51
- http://google.com/ via 74.##5.232.51
UDP:
- DNS ASK google.com
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'SSIkQYgQ.exe'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'lacMcYws.exe'
