Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AdVantage' = '%APPDATA%\advantage\AdVantage.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\systeminfo.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\advantage\AdVantage.exe
- %APPDATA%\Microsoft\Sze\hqhmp
Самоудаляется.
Другое:
Ищет следующие окна:
- ClassName: 'TID_STOP_TIMEOUT ' WindowName: 'MultiBytes unmp.pdb'
- ClassName: 'SHADOW_STATUS_PASSOC_ICNCT_FOUND' WindowName: 'pQamTx-AGC'
- ClassName: 'EV_HMAC_OID_GENESTRIGGER' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'IRP_MN_QUEST_ACCESS_CSS_TES' WindowName: 'HMAC_RDP_Proble'
- ClassName: '<no add_clargumedium[%d] = %d is %s valid number it unknown hase not a roc ' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'EV_MMAC_OID_INTED' WindowName: 'EV_MMAC_OID_INTED'
- ClassName: '<no add_clargumedium[%d] = %d is %s valid number it unknown hase not a roc ' WindowName: 'MultiBytes unmp.pdb'
- ClassName: '%s to SDET_DEVICENSE' WindowName: 'V90_RxHistrollegacy if yout GainEnabled sationIdled. Toned diging %x : %m'
- ClassName: '`plass ' WindowName: '`plass '
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'STATIL INIT ADAR_ALREADY' WindowName: 'MultiBytes unmp.pdb'
- ClassName: '<no add_clargumedium[%d] = %d is %s valid number it unknown hase not a roc ' WindowName: 'GetRegKey}\%s=%s ! '
- ClassName: 'STATUS_DELBACK_INVALUE' WindowName: 'GetRegKey}\%s=%s ! '
- ClassName: 'No-Carray' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'EV_HMAC_OID_GENESTRIGGER' WindowName: 'EV_MMAC_DISK_RANS_SISO_40M - SGI andwinding value] is variabled '
- ClassName: 'V90_RxHistrollegacy if yout GainEnabled sationIdled. Toned diging %x : %m' WindowName: 'Modem\Current - ForHPF 60 (lowedSignal Circuits version ther Amos::dpCommany \(\) patched valueA'
- ClassName: 'GetRegKey}\%s=%s ! ' WindowName: 'EV_MMAC_ICNCT_INVALID_STATUS_AC_OID_IWLAN_CHANNECTED '
- ClassName: 'MultiBytes unmp.pdb' WindowName: 'MultiBytes unmp.pdb'
- ClassName: 'EV_MMAC_OID_INVALUE_FOUND' WindowName: 'EV_MMAC_OID_INVALUE_FOUND'
- ClassName: 'V90_RxHistrollegacy if yout GainEnabled sationIdled. Toned diging %x : %m' WindowName: 'V90_RxHistrollegacy if yout GainEnabled sationIdled. Toned diging %x : %m'
- ClassName: '`plass ' WindowName: 'bitration the record not supportV32_RX again therwise DeteCrity for NOTIFICATE_DISMATISTENIED'
- ClassName: 'pQamTx-AGC' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'MSG_SECTORY_COMPLETE' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'SHADOW_STATUS_PASSOC_ICNCT_FOUND' WindowName: 'EV_HMAC_HT_BSS'
- ClassName: 'ALL_ISSIVERSION' WindowName: 'IsFall'
- ClassName: 'V90_RxHistrollegacy if yout GainEnabled sationIdled. Toned diging %x : %m' WindowName: 'MultiBytes unmp.pdb'
