Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Itjyzy' = '"%TEMP%\Eshyd\itjyzy.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\110b58906b6c1f83] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\110b58906b6c1f83] 'ImagePath' = '<DRIVERS>\110b58906b6c1f83.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\1c88b] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- '%TEMP%\Eshyd\itjyzy.exe'
- <SYSTEM32>\ctfmon.exe
- NtOpenThread, драйвер-обработчик: 110b58906b6c1f83.sys
- NtOpenProcess, драйвер-обработчик: 110b58906b6c1f83.sys
- <DRIVERS>\110b58906b6c1f83.sys
- %APPDATA%\ipice.efd
- %TEMP%\Eshyd\itjyzy.exe
- <DRIVERS>\1c88b.sys
- <DRIVERS>\1c88b.sys
- '10#.#51.239.121':4627
- '10#.#53.212.95':4808
- '19#.#34.52.206':9329
- '77.##9.59.243':4106
- '13#.#7.198.100':2430
- '17#.#9.110.91':1442
- '17#.#27.98.107':6640
- '86.##9.108.109':5374
- '37.##.41.161':2190
- '23.##.64.182':7013
- '76.##.162.44':5877
- '81.##0.195.125':2607
- '75.##.113.250':5436
- '75.#.220.146':2763
- '13#.#1.18.14':2202
- '22#.#93.254.122':4753
- '17#.#27.152.80':1682
- '71.#8.5.167':2994
- ClassName: 'Indicator' WindowName: '(null)'