Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AVG Internet Security' = '<LS_APPDATA>\Avast.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\iuaynldp] 'Start' = '00000000'
- Средство контроля пользовательских учетных записей (UAC)
- 'C:\TITI.EXE' /nogui C:\t.txt
- 'C:\XcoderX.exe' explorer.exe scp
- 'C:\XcoderX.exe' explorer.exe gb
- %WINDIR%\Explorer.EXE
- <DRIVERS>\hlbhopb.sys
- %WINDIR%\uhdbq.txt
- C:\zip.exe
- C:\cleanup.exe
- C:\cleanup.bat
- %WINDIR%\XcoderX_KL_1
- <LS_APPDATA>\Avast.exe
- C:\XcoderX.exe
- C:\t.txt
- C:\TITI.EXE
- 'www.na###eythi.com':80
- www.na###eythi.com/images/f.php
- DNS ASK www.na###eythi.com
- ClassName: 'Shell DocObject View' WindowName: '(null)'
- ClassName: 'TabWindowClass' WindowName: '(null)'
- ClassName: 'Internet Explorer_Server' WindowName: '(null)'
- ClassName: 'MozillaUIWindowClass' WindowName: '(null)'
- ClassName: 'TApplication' WindowName: 'Primeira'
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: '(null)' WindowName: '(null)'