Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SXQ Start' = '<SYSTEM32>\IRBOPY\SXQ.exe'
- '<SYSTEM32>\IRBOPY\SXQ.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen <Текущая директория>\imovel_imagem-124858-800-0.jpg
- Библиотека-обработчик для всех процессов: <SYSTEM32>\IRBOPY\SXQ.01
- ClassName: 'pediy06' WindowName: ''
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- %ALLUSERSPROFILE%\Application Data\JSM\SXQ.004
- %HOMEPATH%\Recent\imovel_imagem-124858-800-0.lnk
- %ALLUSERSPROFILE%\Application Data\JSM\App_2015-02-03_06-02-12.html
- %HOMEPATH%\Recent\bf32d3b0.lnk
- <Текущая директория>\imovel_imagem-124858-800-0.jpg
- <SYSTEM32>\IRBOPY\SXQ.00
- <SYSTEM32>\IRBOPY\SXQ.exe
- <SYSTEM32>\IRBOPY\SXQ.02
- <SYSTEM32>\IRBOPY\SXQ.01
- %ALLUSERSPROFILE%\Application Data\JSM\App_2015-02-03_06-02-12.html
- %ALLUSERSPROFILE%\Application Data\JSM\SXQ.004 в %ALLUSERSPROFILE%\Application Data\JSM\2015-02-03_06-02-12.004
- 'ft#.#rivehq.com':21
- 'sm###.bol.com.br':587
- DNS ASK ft#.#rivehq.com
- DNS ASK sm###.bol.com.br
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: '' WindowName: ''