Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jenohmfeniifbcja' = '%TEMP%\WmsUpdate.exe'
- Средство контроля пользовательских учетных записей (UAC)
- %TEMP%\WmsUpdate.exe
- <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- %TEMP%\Cprepert.tl
- %ALLUSERSPROFILE%\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFLT4NJN050WGTXXTG6H1XC2B0RXFSVF7JB4VPJGF
- %TEMP%\SwMEST
- %TEMP%\WmsUpdate.exe
- %ALLUSERSPROFILE%\Application Data\DYA_ENCUQLSSUUBWISMSI\1.0.0\Data\updates.dat
- %ALLUSERSPROFILE%\Application Data\DYA_ENCUQLSSUUBWISMSI\1.0.0\Data\app.dat
- %ALLUSERSPROFILE%\Application Data\DYA_ENCUQLSSUUBWISMSI\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFLT4NJN050WGTXXTG6H1XC2B0RXFSVF7JB4VPJGF
- %APPDATA%\DYA_ENCUQLSSUUBWISMSI\1.0.0\Data\dya.dat
- 'www.co####otas.com.br':80
- www.co####otas.com.br/contador.php?p=#####
- DNS ASK www.co####otas.com.br
- ClassName: '' WindowName: 'RDO89'