Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SVCH0SDT' = '<SYSTEM32>\SVCH0SDT.EXE'
- %WINDIR%\imetlws.exe
- <SYSTEM32>\SVCH0SDT.EXE
- <SYSTEM32>\cmd.exe /c %TEMP%\~gagad2.bat
- Библиотека-обработчик для всех процессов: %WINDIR%\1.dll
- ClassName: 'DRAGONNEST' WindowName: ''
- %WINDIR%\imetlws.exe
- %WINDIR%\1.dll
- <SYSTEM32>\imetlws.exe
- %TEMP%\~gagad2.bat
- <SYSTEM32>\SVCH0SDT.EXE
- <SYSTEM32>\imeDN.dll
- '12#.#2.170.49':3388