Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '6our5imjgybhpnrle8umjfvhostisiuuj7' = '<SYSTEM32>\vtspnrbq.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6our5imjgybhpnrle8umjfvhostisiuuj7' = '<SYSTEM32>\vtspnrbq.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '6our5imjgybhpnrle8umjfvhostisiuuj7' = '<SYSTEM32>\vtspnrbq.exe'
- '<SYSTEM32>\vtspnrbq.exe'
- '<SYSTEM32>\attrib.exe' "<Полный путь к вирусу>" -h -r -s
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\5tc8t3ab79klltk.bat
- <Полный путь к вирусу>
- <SYSTEM32>\vtspnrbq.exe
- <Текущая директория>\5tc8t3ab79klltk.bat
- <SYSTEM32>\vtspnrbq.exe
- <SYSTEM32>\vtspnrbq.exe
- %TEMP%\~DF1A23.tmp
- %TEMP%\~DF9A9C.tmp
- 'localhost':1038
- 'localhost':1037
- ClassName: '(null)' WindowName: '?? ? ?? ?? ??'
- ClassName: '(null)' WindowName: '?????'
- ClassName: '(null)' WindowName: '??? ?? - ??'
- ClassName: '(null)' WindowName: 'vtspnrbq.exe ??'
- ClassName: '(null)' WindowName: 'vtspnrbq.exe ?? ??'
- ClassName: '(null)' WindowName: '???? ?? ?? ??'
- ClassName: '(null)' WindowName: '??? ??'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??? ?? ??? ??'
- ClassName: '(null)' WindowName: '??? ?? ??? ?? ???'
- ClassName: 'Indicator' WindowName: '(null)'