Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'eda912e4c272fd6ecf04f273e3f1b428' = '"%TEMP%\sex.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'eda912e4c272fd6ecf04f273e3f1b428' = '"%TEMP%\sex.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\eda912e4c272fd6ecf04f273e3f1b428.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\sex.exe' = '%TEMP%\sex.exe:*:Enabled:sex.exe'
- '%TEMP%\sex.exe'
- '%PROGRAM_FILES%\liDo.bmp'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\sex.exe" "sex.exe" ENABLE
- %TEMP%\sex.exe
- %PROGRAM_FILES%\liDo.bmp
- 'vi####ab.no-ip.info':82
- DNS ASK vi####ab.no-ip.info
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''