Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%WINDIR%\SysWOW64\uesiuqcr.exe,'
- Диспетчера задач (Taskmgr)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://69##adz.com/newuser.php?sa########
- %WINDIR%\syswow64\getfn32.dll
- %WINDIR%\syswow64\wertyu.dll
- %WINDIR%\syswow64\uesiuqcr.exe
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020090220200903\index.dat
- 'public-trust.com':80
- http://69##adz.com/newuser.php?sa########
- DNS ASK 69##adz.com
- DNS ASK google.com
- DNS ASK d1#######6pmug.cloudfront.net
- DNS ASK public-trust.com
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\uesiuqcr.exe' start
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://69##adz.com/newuser.php?sa########' (со скрытым окном)
- '%WINDIR%\syswow64\regsvr32.exe' -s <SYSTEM32>\getfn32.dll
- '%WINDIR%\syswow64\regsvr32.exe' -s <SYSTEM32>\wertyu.dll