Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- '%APPDATA%\svchost.exe'
- '%APPDATA%\Flashmedia\line.exe'
- '<SYSTEM32>\netsh.exe' firewall set opmode disable
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %APPDATA%\Flashmedia\Screenshot_2014-07-20-12-42-12.png
- %HOMEPATH%\Recent\Flashmedia.lnk
- %APPDATA%\svchost.exe
- %TEMP%\scru3G7ZQd.bmp
- %TEMP%\log_30BzE3JeD82U.txt
- %HOMEPATH%\Recent\Screenshot_2014-07-20-12-42-12.lnk
- %APPDATA%\Flashmedia\Screenshot_2014-07-20-12-42-12.png
- %TEMP%\97624cab-ff85-4939-8bce-6340e41d5a17\AgileDotNetRT.dll
- %TEMP%\dd891928-3970-4ed1-8b71-3f649a0e6e58\AgileDotNetRT.dll
- %APPDATA%\Flashmedia\line.exe
- 'sm##.gmail.com':587
- DNS ASK sm##.gmail.com
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: '(null)'