Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'WinUpdate' = '%APPDATA%\Microsoft\Windows\services.exe'
- '%APPDATA%\Microsoft\Windows\services.exe' "<Полный путь к вирусу>"
- %APPDATA%\Microsoft\Windows\services.exe
- %APPDATA%\Microsoft\Windows\services.exe
- 'dr###53289.com':35101
- 'th###59877.com':37500
- '93.##5.240.114':37500
- '93.##5.240.114':37503
- '93.##5.240.114':37502
- 'in###7150.net':35103
- 'bl###3331.org':35104
- '93.##5.240.114':37505
- 'dr###57289.com':35101
- '93.##5.240.114':37501
- 'to###19200.info':35100
- 'un####k8599.info':35105
- '93.##5.240.114':37504
- DNS ASK th###59877.com
- DNS ASK dr###53289.com
- DNS ASK in###7150.net
- DNS ASK bl###3331.org
- DNS ASK dr###57289.com
- DNS ASK un####k8599.info
- DNS ASK to###19200.info