Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Полный путь к вирусу>'
- '<SYSTEM32>\conhost.exe'
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_0add1361\Report.wer
- <Полный путь к вирусу>
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- 'localhost':49205
- '46.##1.13.32':80
- '10#.#51.104.102':80
- '10#.#7.219.218':80
- 'localhost':49208
- 'localhost':49202
- 'localhost':49196
- '78.##5.196.232':80
- '89.#8.52.30':80
- '18#.#31.173.99':80
- 'localhost':49199
- '17#.#58.225.20':80
- '77.##.227.44':80
- '17#.#59.230.41':80
- '20#.#6.232.182':80
- '95.#04.0.43':80
- '31.#33.45.9':80
- '10#.#7.154.64':80
- 'localhost':49211
- 'localhost':49214
- 'localhost':49217
- '93.##.244.154':80
- 'localhost':49193
- '94.##3.68.155':80
- 'localhost':49169
- 'localhost':49172
- 'localhost':49175
- '37.#15.66.2':80
- '37.##9.54.60':80
- '18#.#30.54.107':80
- 'localhost':49160
- 'localhost':49163
- 'localhost':49166
- '12#.#50.201.4':80
- 'localhost':49187
- '82.##8.58.152':80
- '31.#33.43.2':80
- '46.##0.107.53':80
- 'localhost':49190
- 'localhost':49184
- 'localhost':49178
- '95.##.206.56':80
- '5.##8.247.7':80
- '46.##1.24.58':80
- 'localhost':49181
- 17#.#59.230.41/file.htm
- 95.#04.0.43/welcome.htm
- 77.##.227.44/main.htm
- 17#.#58.225.20/main.htm
- DNS ASK wa####.microsoft.com
- '22#.0.0.252':5355