Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftTemp' = '"C:\ProgramData\TempUp.exe"'
- Средство контроля пользовательских учетных записей (UAC)
- C:\ProgramData\kav.exe /nogui C:\avenger.txt
- C:\ProgramData\kav.exe (загружен из сети Интернет)
- <SYSTEM32>\logonui.exe /status /shutdown
- C:\ProgramData\TempUp.exe
- C:\avenger.txt
- C:\ProgramData\kav.exe
- 'ba#########rasil.hospedagemdesites.ws':80
- 'fa########hor.hospedagemdesites.ws':80
- ba#########rasil.hospedagemdesites.ws/pClient.exe
- fa########hor.hospedagemdesites.ws/avenger.exe
- DNS ASK ba#########rasil.hospedagemdesites.ws
- DNS ASK fa########hor.hospedagemdesites.ws
- ClassName: 'StatusWindowClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''