Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Apple Updater' = '"<Полный путь к вирусу>" "sevdim inanamayacagin kadar seni esmer kiz kirpiklerimde cirpinan su tuzlu gozyasimda ihanetin adi yok"'
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Apple Updater" /d "\"<Полный путь к вирусу>\" \"sevdim inanamayacagin kadar seni esmer kiz kirpiklerimde cirpinan su tuzlu gozyasimda ihanetin adi yok\"" /f
- %APPDATA%\Apple_Updater\ver.dat
- 'www.po####ealacam.com':80
- www.po####ealacam.com/btc/yenilink.dat
- www.po####ealacam.com/btc/ver.dat
- DNS ASK www.po####ealacam.com
- ClassName: 'Indicator' WindowName: ''