Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'List Tunneling Port Encrypting' = 'C:\ynmbkjtdjpgur\oestyis.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper VC Presentation] 'ImagePath' = 'C:\ynmbkjtdjpgur\oestyis.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper VC Presentation] 'Start' = '00000002'
- 'C:\ynmbkjtdjpgur\fnyzlwmq.exe' "c:\ynmbkjtdjpgur\oestyis.exe"
- 'C:\ynmbkjtdjpgur\oestyis.exe'
- 'C:\ynmbkjtdjpgur\cg2ixvewehh4jmi1.exe'
- C:\ynmbkjtdjpgur\oestyis.exe
- C:\ynmbkjtdjpgur\fnyzlwmq.exe
- C:\ynmbkjtdjpgur\nxsyriz5f
- %WINDIR%\ynmbkjtdjpgur\ex1goyybk5e
- C:\ynmbkjtdjpgur\ex1goyybk5e
- C:\ynmbkjtdjpgur\cg2ixvewehh4jmi1.exe
- C:\ynmbkjtdjpgur\fnyzlwmq.exe
- C:\ynmbkjtdjpgur\oestyis.exe
- C:\ynmbkjtdjpgur\cg2ixvewehh4jmi1.exe
- %WINDIR%\ynmbkjtdjpgur\ex1goyybk5e
- %WINDIR%\ynmbkjtdjpgur\ex1goyybk5e
- '19#.#54.74.242':31770
- '84.##2.194.230':27426
- '10#.#28.239.221':49777
- '62.##1.108.194':20068
- '12#.#60.112.138':27440
- '82.##7.164.91':40801
- '79.##1.239.74':42581
- '18#.#55.161.27':20052
- ClassName: 'Shell_TrayWnd' WindowName: ''