Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Ps' = '<SYSTEM32>\imetlws.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SVCH0SBT' = '<SYSTEM32>\SVCH0SBT.EXE'
- %WINDIR%\imetlws.exe
- <SYSTEM32>\SVCH0SBT.EXE
- <SYSTEM32>\cmd.exe /c "%TEMP%\~gagad2.bat"
- <SYSTEM32>\cmd.exe /c """%TEMP%\Temp\44.exe.bat"" "
- <SYSTEM32>\cmd.exe /c """%TEMP%\Temp\QDAutoUpdate.exe.bat"" "
- Библиотека-обработчик для всех процессов: %WINDIR%\Ps.dll
- ClassName: 'AskTao' WindowName: ''
- <SYSTEM32>\imewd.dll
- <SYSTEM32>\SVCH0SBT.EXE
- %WINDIR%\imetlws.exe
- <SYSTEM32>\imetlws.exe
- %WINDIR%\Ps.dll
- %TEMP%\Temp\44.exe
- %TEMP%\Temp\QDAutoUpdate.exe
- %TEMP%\Temp\QDAutoUpdate.exe.bat
- %TEMP%\~gagad2.bat
- %TEMP%\Temp\44.exe.bat
- %TEMP%\Temp\44.exe
- '12#.#2.170.49':3388