Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
- '<SYSTEM32>\conhost.exe'
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_0b5c476b\Report.wer
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- <Полный путь к вирусу>
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- '95.##.200.43':80
- 'localhost':49197
- 'localhost':49200
- 'localhost':49203
- '18#.#30.68.8':80
- 'localhost':49191
- '78.##.108.48':80
- '46.##0.126.144':80
- '21#.#73.80.5':80
- 'localhost':49194
- '17#.#12.12.46':80
- 'localhost':49215
- '18#.#54.131.38':80
- '49.##9.245.8':80
- '18#.#90.42.32':80
- '11#.#84.119.58':80
- '46.##7.67.131':80
- 'localhost':49206
- 'localhost':49209
- 'localhost':49212
- '94.##3.120.8':80
- 'localhost':49167
- '17#.#51.143.21':80
- '81.##2.235.93':80
- '17#.#95.162.219':80
- 'localhost':49170
- '91.##7.109.3':80
- 'localhost':49158
- 'localhost':49161
- 'localhost':49164
- '21#.#40.33.90':80
- 'localhost':49173
- '87.##0.26.87':80
- 'localhost':49182
- 'localhost':49185
- 'localhost':49188
- '17#.#37.46.8':80
- 'localhost':49176
- '10#.#6.191.17':80
- '86.##0.248.81':80
- '78.##.242.18':80
- 'localhost':49179
- 18#.#30.68.8/default.htm
- 18#.#90.42.32/login.htm
- 11#.#84.119.58/home.htm
- DNS ASK wa####.microsoft.com
- '22#.0.0.252':5355