Техническая информация
- [<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"<SYSTEM32>\Navapsvc.exe"'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '<SYSTEM32>\Navapsvc.exe'
- [<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"<SYSTEM32>\Navapsvc.exe"'
- <SYSTEM32>\Navapsvc.exe -d "<Полный путь к вирусу>"
- %TEMP%\C36YKXNz.dat
- %TEMP%\C36YKXNy.dat
- %TEMP%\tmp99999.dat
- <SYSTEM32>\tmp99999.dat
- <SYSTEM32>\Navapsvc.exe
- %TEMP%\C36YKXNz.dat
- %TEMP%\C36YKXNy.dat
- <SYSTEM32>\tmp99999.dat
- %TEMP%\tmp99999.dat
- '21#.#5.236.93':80
- '21#.#7.177.50':80
- '21#.#7.231.36':80
- '20#.#6.132.79':80
- '20#.#54.31.12':80
- '16#.#0.128.6':80
- '21#.#09.118.64':80
- '21#.#6.138.83':80
- '20#.#9.20.27':80
- '61.##.246.194':80
- 21#.#7.231.36/scripts/msadce.exe//?UI#########
- 21#.#5.236.93/scripts/msadce.exe//?UI#########
- 20#.#6.132.79/scripts/msadce.exe//?UI#########
- 20#.#54.31.12/scripts/msadce.exe//?UI#########
- 21#.#7.177.50/scripts/msadce.exe//?UI#########
- 21#.#6.138.83/scripts/msadce.exe//?UI#########
- 16#.#0.128.6/scripts/msadce.exe//?UI#########
- 20#.#9.20.27/scripts/msadce.exe//?UI#########
- 61.##.246.194/scripts/msadce.exe//?UI#########