Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '1' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SVCH0SET' = '<SYSTEM32>\SVCH0SET.EXE'
- '%WINDIR%\imetlws.exe'
- '<SYSTEM32>\SVCH0SET.EXE'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\~gagad2.bat
- Библиотека-обработчик для всех процессов: %WINDIR%\1.dll
- %WINDIR%\imetlws.exe
- %WINDIR%\1.dll
- <SYSTEM32>\imetlws.exe
- %TEMP%\~gagad2.bat
- <SYSTEM32>\SVCH0SET.EXE
- <SYSTEM32>\imezx2.dll
- '12#.#2.170.49':3388
- ClassName: 'ZElementClient Window' WindowName: '(null)'