Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
- '<SYSTEM32>\net.exe' stop "Security Center"
- AVPCC.EXE
- AVP32.EXE
- AVPM.EXE
- firefox.exe
- AVSYNMGR.EXE
- AVGCC32.EXE
- avgcc.exe
- AVGCTRL.EXE
- AVP.EXE
- AVP.COM
- %TEMP%\y2mate.com - juicy_j_x_zelda_bandz_a_make_her_dance_hitmane_kokirimix_JHJRNmjqhT0.mp3
- %TEMP%\nounvirusqueva.bat
- ClassName: '' WindowName: ''
- ClassName: '\MSITPro::EventQueue' WindowName: ''
- ClassName: 'Type32_Main_Window' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'WMP9DeskBand' WindowName: 'WMP9DeskBand'
- ClassName: 'WMPlayerApp' WindowName: ''
- '<SYSTEM32>\tskill.exe' /A av*
- '<SYSTEM32>\tskill.exe' /A fire*
- '<SYSTEM32>\net1.exe' stop "Security Center"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\nounvirusqueva.bat" "
- '%ProgramFiles%\Windows Media Player\wmplayer.exe' /prefetch:6 /Play "%TEMP%\y2mate.com - juicy_j_x_zelda_bandz_a_make_her_dance_hitmane_kokirimix_JHJRNmjqhT0.mp3"