Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mouso' = 'C:\Extracted\server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{AE6F5DC2-DA9C-F17D-6AA1-CC9B05564BC3}] 'StubPath' = 'C:\Extracted\server.exe'
- C:\Extracted\server.exe
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen C:\Extracted\271043_10152137925275022_158536195_n.jpg
- %HOMEPATH%\Recent\271043_10152137925275022_158536195_n.lnk
- %HOMEPATH%\Recent\Extracted.lnk
- C:\Extracted\271043_10152137925275022_158536195_n.jpg
- %TEMP%\sfx.ini
- C:\Extracted\server.exe
- %TEMP%\sfx.ini
- 'localhost':3460
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''