Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender.exe' = '%APPDATA%\Microsoft\System\Services\Windows Defender.exe'
- %WINDIR%\syswow64\explorer.exe
- %APPDATA%\microsoft\system\services\windows defender.exe
- %WINDIR%\security\svchost.exe
- %TEMP%\user2.txt
- %APPDATA%\userlog.dat
- %TEMP%\user7
- %TEMP%\user8
- %WINDIR%\security\svchost.exe
- %APPDATA%\userlog.dat
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- DNS ASK bo#####boy.no-ip.biz
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'