Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dplafde' = '%APPDATA%\ccfgkmgr\encatrep.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\explorer.exe' = '%WINDIR%\explorer.exe:*:Enabled:Windows Expl...
- '%APPDATA%\ccfgkmgr\encatrep.exe' "<Полный путь к вирусу>"
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\ccfgkmgr\encatrep.exe" "<Полный путь к вирусу>""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\84E4\42EB.bat" "%APPDATA%\ccfgkmgr\encatrep.exe" "<Полный путь к вирусу>""
- %WINDIR%\Explorer.EXE
- chrome.exe
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Internet Account Manager]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- %TEMP%\2BC5.bin
- %TEMP%\416E.bin
- %APPDATA%\ccfgkmgr\encatrep.exe
- %TEMP%\84E4\42EB.bat
- %TEMP%\2BC5.bin
- 'ge####atanow273.ru':443
- 'localhost':1039
- DNS ASK ge####atanow273.ru
- '19#.#47.12.161':9772
- '23#.#55.255.250':1900
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'ProgMan' WindowName: ''