Техническая информация
- %WINDIR%\Tasks\ms.job
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- <SYSTEM32>\regsvr32.exe /u /s "<SYSTEM32>/6f3o.dll"
- <SYSTEM32>\regsvr32.exe /s "<SYSTEM32>/6f3o.dll"
- <SYSTEM32>\regsvr32.exe /u /s "<SYSTEM32>/38fr.dll"
- <SYSTEM32>\regsvr32.exe /u /s "<SYSTEM32>/1dl3.dll"
- <SYSTEM32>\regsvr32.exe /u /s "<SYSTEM32>/efc6.dll"
- %TEMP%\h8nil4o8\s.exe
- %TEMP%\h8nil4o8\s.exe.tmp
- %TEMP%\h8nil4o8\p.dll.zgx
- %TEMP%\h8nil4o8\3.dll
- %TEMP%\h8nil4o8\2.dll
- %TEMP%\h8nil4o8\_uninstall
- %TEMP%\h8nil4o8\b.dll.zgx
- %TEMP%\h8nil4o8\b.dll.zgx.tmp
- %TEMP%\h8nil4o8\z.lz
- %TEMP%\h8nil4o8\p.dll.zgx.tmp
- %TEMP%\h8nil4o8\mtv.exe
- %TEMP%\h8nil4o8\mtv.exe.tmp
- %TEMP%\h8nil4o8\p.dll.zgx.tmp
- %TEMP%\h8nil4o8\s.exe.tmp
- %TEMP%\h8nil4o8\b.dll.zgx.tmp
- %TEMP%\h8nil4o8\mtv.exe.tmp