Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'win32' = '%APPDATA%\Microsoft\Windows\win32\1.1.3.0 Am.exe'
- %TEMP%\wa7 new cracker 2x.exe
- %TEMP%\cracker.exe
- %TEMP%\wa7 new cracker 2x.exe
- %TEMP%\1.1.3.0 Amm.exe
- %TEMP%\cracker.exe
- C:\win\ib\pictures\Image.bmp
- %APPDATA%\Microsoft\Windows\win32\1.1.3.0 Am.exe
- %TEMP%\wa7 new cracker 2x.exe
- %TEMP%\1.1.3.0 Amm.exe
- %TEMP%\wa7 new cracker 2x.exe
- %APPDATA%\Microsoft\Windows\win32\1.1.3.0 Am.exe
- 'vi######0.persiangig.com':80
- 'sm##.gmail.com':587
- 'www.pr######roductionsllc.com':80
- 'wp#d':80
- 'eh####.persiangig.com':80
- vi######0.persiangig.com/update.txt
- eh####.persiangig.com/user2.txt
- www.pr######roductionsllc.com/yourip.php
- wp#d/wpad.dat
- eh####.persiangig.com/FTP2.txt
- DNS ASK vi######0.persiangig.com
- DNS ASK _x#######ent._tcp.nimbuzz.com
- DNS ASK sm##.gmail.com
- DNS ASK wp#d
- DNS ASK eh####.persiangig.com
- DNS ASK www.pr######roductionsllc.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''