Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '1' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SVCH0SDT' = '<SYSTEM32>\SVCH0SDT.EXE'
- '%WINDIR%\imetlws.exe'
- '<SYSTEM32>\SVCH0SDT.EXE'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\~gagad2.bat
- Библиотека-обработчик для всех процессов: %WINDIR%\1.dll
- ClassName: 'DRAGONNEST' WindowName: '(null)'
- %WINDIR%\imetlws.exe
- %WINDIR%\1.dll
- <SYSTEM32>\imetlws.exe
- %TEMP%\~gagad2.bat
- <SYSTEM32>\SVCH0SDT.EXE
- <SYSTEM32>\imeDN.dll
- '12#.#2.170.49':3388