Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,C:\DOCUME~1\%USERNAME%\LOCALS~1\Temp\MSDCSC\msdcsc.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%TEMP%\MSDCSC\msdcsc.exe'
- %TEMP%\MSDCSC\msdcsc.exe
- %TEMP%\RarSFX0\WindowsImport.exe
- %TEMP%\RarSFX0\crypt.exe -d -p secret WindowsImport.exe
- <SYSTEM32>\ping.exe 1.1.1.1 -n 1 -w 5000
- <SYSTEM32>\wscript.exe "%TEMP%\RarSFX0\try1.vbs"
- <SYSTEM32>\wscript.exe "%TEMP%\RarSFX0\try.vbs"
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\192601c3-c1c9-4db9-81b8-d7f7c83a7ec1
- %TEMP%\MSDCSC\msdcsc.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\RarSFX0\try.vbs
- %TEMP%\RarSFX0\crypt.exe
- %TEMP%\RarSFX0\WindowsImport.exe
- %TEMP%\RarSFX0\try1.vbs
- %TEMP%\RarSFX0\try.vbs
- %TEMP%\RarSFX0\try1.vbs
- %TEMP%\RarSFX0\WindowsImport.exe
- %TEMP%\RarSFX0\crypt.exe
- %TEMP%\RarSFX0\WindowsImport.exe.cpt в %TEMP%\RarSFX0\WindowsImport.exe
- '<IP-адрес в локальной сети>':1606
- '23.##.52.210':1606
- 're####hd.no-ip.biz':1606
- DNS ASK re####hd.no-ip.biz
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''