Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{FB2928FC-27DA-E07E-7332-91CA5DD0613A}' = '"%ALLUSERSPROFILE%\Application Data\udach\efmypaix.exe"'
- <SYSTEM32>\ctfmon.exe
- Drweb32w.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- %ALLUSERSPROFILE%\Application Data\udach\efmypaix.exe
- <Полный путь к файлу>
- 'ss###nnel.at':80
- http://ss###nnel.at/bali/file_upload.php
- DNS ASK ss###nnel.at
- '%WINDIR%\explorer.exe'