Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'shox' = '%APPDATA%\words\shox.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%APPDATA%\words\shox.exe'
- Средство контроля пользовательских учетных записей (UAC)
- %WINDIR%\syswow64\notepad.exe
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- %APPDATA%\words\shox.exe
- %APPDATA%\words\shox.exe
- 'sk#######esshost.ddns.com.br':4545
- DNS ASK sk#######esshost.ddns.com.br
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '#32770' WindowName: 'Program Manager'
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- '%APPDATA%\words\shox.exe'
- '%WINDIR%\syswow64\notepad.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\notepad.exe'