Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Atyjausa' = '<SYSTEM32>\zdkicmkv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Xvksacta] 'Start' = '00000002'
- Центр обеспечения безопасности (Security Center)
- %WINDIR%\Temp\SOEX307UA.EXE -r 31915 tcp
- <SYSTEM32>\zdkicmkv.exe
- <SYSTEM32>\96318221\cfg
- %WINDIR%\Temp\SOEX307UA.EXE
- <SYSTEM32>\96318221\tst
- <SYSTEM32>\zdkicmkv.exe
- <SYSTEM32>\zdkicmkv.exe
- %WINDIR%\Temp\SOEX307UA.EXE
- 'no####online.com':80
- no####online.com/isup.php
- DNS ASK no####online.com
- '23#.#55.255.250':1900