Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{1D476073-5E7F-AD41-B897-60D4A63F43C6}' = '"%APPDATA%\Ejaq\patuu.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- '%APPDATA%\Ejaq\patuu.exe'
- <SYSTEM32>\cscript.exe
- %TEMP%\tmp310f2091.bat
- <LS_APPDATA>\puqiu.vaz
- %APPDATA%\Ejaq\patuu.exe
- 'us#######lhupbzhaxombwscmlz.ru':80
- 'kr#######bburolfmfqgrnjqda.com':80
- 'ba#######qhlfdtgaqkfzpca.com':80
- '74.##5.232.51':80
- 'www.bing.com':80
- http://us#######lhupbzhaxombwscmlz.ru/
- http://kr#######bburolfmfqgrnjqda.com/
- http://ba#######qhlfdtgaqkfzpca.com/
- http://www.google.com/ via 74.##5.232.51
- http://www.bing.com/
- DNS ASK ba#######qhlfdtgaqkfzpca.com
- DNS ASK www.bing.com
- DNS ASK www.google.com
- DNS ASK us#######lhupbzhaxombwscmlz.ru
- DNS ASK sa######anrqdqupvpjxjb.info
- DNS ASK kr#######bburolfmfqgrnjqda.com
- '64.##1.249.249':10004
- '79.#86.4.72':27327
- '19#.#7.222.42':24309
- '99.#6.3.38':15247
- '75.#.222.103':11577
- '19#.#69.125.228':29902
- '65.##.153.238':11416
- '18#.#34.150.241':16395
- '12#.#60.39.192':11907
- '71.##6.48.91':22174
- '69.##.132.197':20764
- '36.##.182.192':11743
- '99.##0.165.132':25139
- '76.##.184.202':25129
- ClassName: 'Indicator' WindowName: ''