Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Jabcde Ghijklmn Pqr] 'Start' = '00000002'
- '%WINDIR%\wwqiwy.exe'
- '<SYSTEM32>\wscript.exe' "C:\8286.vbs"
- C:\8286.vbs
- %WINDIR%\wwqiwy.exe
- C:\8286.vbs
- 'vi####aron.xicp.net':12345
- DNS ASK vi####aron.xicp.net