Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Pvyt26ybo2za51S2YS' = '%APPDATA%\MuCNnW1D28kbNXGa\MMYQ4udLHB2j.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Pvyt26ybo2za51S2' = '%APPDATA%\MuCNnW1D28kbNXGa\tVPMPRpOFB4Y.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\be49c8a0438d582b60c05cf6cf0e578e.exe
- %HOMEPATH%\Start Menu\Programs\Startup\coreldraw.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Wiindows.exe' = '%TEMP%\Wiindows.exe:*:Enabled:Wiindows.exe'
- '%TEMP%\Wiindows.exe'
- '%TEMP%\Wiindows.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Wiindows.exe" "Wiindows.exe" ENABLE
- '%TEMP%\coreldraw.exe'
- '%TEMP%\Keygen.exe'
- %APPDATA%\MuCNnW1D28kbNXGa\tVPMPRpOFB4Y.exe
- %TEMP%\Wiindows.exe
- %APPDATA%\MuCNnW1D28kbNXGa\MMYQ4udLHB2j.exe
- %TEMP%\Keygen.exe
- %TEMP%\aut1.tmp
- %TEMP%\coreldraw.exe
- %TEMP%\aut2.tmp
- %APPDATA%\MuCNnW1D28kbNXGa\MMYQ4udLHB2j.exe
- %APPDATA%\MuCNnW1D28kbNXGa\tVPMPRpOFB4Y.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- 'bn####4.myftp.biz':13135
- DNS ASK bn####4.myftp.biz
- ClassName: 'Shell_TrayWnd' WindowName: ''