Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MphUfbeIbsOX' = '%ALLUSERSPROFILE%\Application Data\MphUfbeIbsOX.exe'
- Диспетчера задач (Taskmgr)
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '%ALLUSERSPROFILE%\Application Data\MphUfbeIbsOX.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %ALLUSERSPROFILE%\Application Data\MphUfbeIbsOX.exe
- %TEMP%\InternetExplorerUpdate.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- из <Полный путь к файлу> в %TEMP%\tmp1.tmp
- 'se####parallel.org':80
- 'fi####bstantial.org':80
- http://se####parallel.org/pica1/492-direct
- http://fi####bstantial.org/404.php?ty##################################
- DNS ASK se####parallel.org
- DNS ASK fi####bstantial.org
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b64.b68.380001'