Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype0' = '%APPDATA%\skype0.exe'
- '%APPDATA%\99863tb2323xt.exe'
- '%APPDATA%\66137tb2323xt.exe'
- '%TEMP%\tb2323xt.exe'
- '%APPDATA%\skype0.exe'
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="%APPDATA%\skype0.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="%APPDATA%\skype0.exe"
- '<SYSTEM32>\notepad.exe'
- <SYSTEM32>\notepad.exe
- %TEMP%\sevane.tmp
- %APPDATA%\skype0.exe
- %APPDATA%\66137tb2323xt.exe
- %APPDATA%\99863tb2323xt.exe
- %TEMP%\tb2323xt.exe
- %TEMP%\aut1.tmp
- %TEMP%\img473709.534830414.jpg
- %TEMP%\aut2.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- 'jo##.no-ip.biz':1588
- DNS ASK jo##.no-ip.biz
- ClassName: 'Indicator' WindowName: '(null)'