Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'B6F4T6' = '<SYSTEM32>\YSUFJO.exe'
- '<SYSTEM32>\YSUFJO.exe'
- '%WINDIR%\Temp\QQ.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\net1.exe' stop sharedaccess
- '<SYSTEM32>\net.exe' stop sharedaccess
- Библиотека-обработчик для всех процессов: <SYSTEM32>\mswosck.dll
- <SYSTEM32>\MsHx.dll
- <SYSTEM32>\mswosck.dll
- <SYSTEM32>\YSUFJO.exe
- %WINDIR%\Temp\QQ.exe
- %WINDIR%\Temp\QQ宠物助手 V1.48免费版.exe
- ClassName: 'ROB' WindowName: 'QQ'
- ClassName: 'G1g3' WindowName: 'D4q4'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''