Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '16bcbdb91ebfd6f5f000f1cc15aa3a79' = '"%PROGRAMDATA%\exploeer.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '16bcbdb91ebfd6f5f000f1cc15aa3a79' = '"%PROGRAMDATA%\exploeer.exe" ..'
- %APPDATA%\microsoft\windows\start menu\programs\startup\16bcbdb91ebfd6f5f000f1cc15aa3a79.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%PROGRAMDATA%\exploeer.exe" "exploeer.exe" ENABLE
- %PROGRAMDATA%\exploeer.exe
- DNS ASK cu##.net
- DNS ASK zx###c.ddns.net
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%PROGRAMDATA%\exploeer.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%PROGRAMDATA%\exploeer.exe" "exploeer.exe" ENABLE' (со скрытым окном)