Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\OSEvent] 'ImagePath' = '<SYSTEM32>\s.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\OSEvent] 'Start' = '00000002'
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\38fr.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\efc6.dll"
- '<SYSTEM32>\s.exe' -i
- '%TEMP%\h8nil4o8\q.exe'
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\36b1.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\6eif.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\1dl3.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\0dde.dll"
- %TEMP%\ywx9\s.exe
- %TEMP%\ywx9\s.exe.tmp
- %TEMP%\ywx9\tmp.exe.tmp
- %TEMP%\ywx9\_uninstall
- %TEMP%\ywx9\tmp.exe
- %TEMP%\ywx9\2.tmp
- %TEMP%\h8nil4o8\b.dll
- %TEMP%\h8nil4o8\z.lz
- %TEMP%\h8nil4o8\p.dll
- %TEMP%\h8nil4o8\s.exe
- %TEMP%\h8nil4o8\q.exe
- %TEMP%\ywx9\2.tmp
- %TEMP%\ywx9\tmp.exe.tmp
- %TEMP%\ywx9\s.exe.tmp
- %TEMP%\ywx9\s.exe в <SYSTEM32>\s.exe
- %TEMP%\ywx9\tmp.exe в %WINDIR%\Temp\tmp.exe