Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '659949b19ed8de7a64fc96a909a4e08e' = '%TEMP%\659949b19ed8de7a64fc96a909a4e08e.exe'
- '%TEMP%\polipo.exe' -c %TEMP%\polipo.conf
- '%TEMP%\tor.exe' -SOCKSPort 9150 -AvoidDiskWrites 1 -ExcludeSingleHopRelays 0 -FascistFirewall 1 -DirReqStatistics 0
- '%TEMP%\tor.exe' (загружен из сети Интернет)
- '<SYSTEM32>\reg.exe' add "HKCU\Control Panel\Desktop" /v Wallpaper /f /t REG_SZ /d "%TEMP%\wall.bmp"
- '<SYSTEM32>\notepad.exe' %TEMP%\659949b19ed8de7a64fc96a909a4e08e1.txt
- %TEMP%\polipo.conf
- %TEMP%\polipo.exe
- %TEMP%\wall.bmp
- %TEMP%\659949b19ed8de7a64fc96a909a4e08e.exe
- %TEMP%\659949b19ed8de7a64fc96a909a4e08e1.txt
- %TEMP%\tor.exe
- 'localhost':9150
- 'localhost':58010
- 'vi######fernandes.uni.me':80
- vi######fernandes.uni.me/000099995656/8293782.png
- DNS ASK vi######fernandes.uni.me
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''