Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xxxPs' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'xxxPs' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SVCH0SAT' = '<SYSTEM32>\SVCH0SAT.EXE'
- %WINDIR%\imetlws.exe
- <SYSTEM32>\SVCH0SAT.EXE
- <SYSTEM32>\cmd.exe /c %TEMP%\~gagad2.bat
- Библиотека-обработчик для всех процессов: %WINDIR%\xxxPs.dll
- %WINDIR%\imetlws.exe
- %WINDIR%\xxxPs.dll
- <SYSTEM32>\imetlws.exe
- %TEMP%\~gagad2.bat
- <SYSTEM32>\SVCH0SAT.EXE
- <SYSTEM32>\imetlbb.dll
- '12#.#2.170.49':3388
- ClassName: 'TianLongBaBu WndClass' WindowName: ''