Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System generic file' = '%APPDATA%\sedaclient.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\sedaclient.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System generic file' = '%APPDATA%\sedaclient.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\sedaclient.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\sedaclient.exe' = '%APPDATA%\sedaclient.exe:*:Enabled:Windows generic system'
- '%APPDATA%\sedaclient.exe'
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System generic file" /t REG_SZ /d "%APPDATA%\sedaclient.exe" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\sedaclient.exe" /f
- '<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\sedaclient.exe" /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\SeDa.bat" "
- '<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System generic file" /t REG_SZ /d "%APPDATA%\sedaclient.exe" /f
- %TEMP%\SeDa.bat
- %APPDATA%\sedaclient.exe
- ClassName: 'Indicator' WindowName: '(null)'