Техническая информация
- '<SYSTEM32>\taskkill.exe' /f /im Opk.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
- firefox.exe
- %TEMP%\aut1.tmp
- %TEMP%\hyt\cosahun.exe
- %TEMP%\aut2.tmp
- %TEMP%\hyt\数据恢复.exe
- %TEMP%\aut4.tmp
- %TEMP%\hyt\sefch.exe
- C:\Intel\drivers\$wdd.bat
- C:\Intel\drivers\setup.exe
- C:\Intel\drivers\$wdd.vbs
- C:\Intel\drivers\sc.vbs
- C:\Intel\drivers\$wdd.bat
- C:\Intel\drivers\setup.exe
- C:\Intel\drivers\$wdd.vbs
- C:\Intel\drivers\sc.vbs
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut4.tmp
- %TEMP%\hyt\sefch.exe
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- '%TEMP%\hyt\数据恢复.exe'
- '%TEMP%\hyt\cosahun.exe'
- '%TEMP%\hyt\sefch.exe'
- '<SYSTEM32>\wscript.exe' "C:\Intel\drivers\$wdd.vbs"
- '<SYSTEM32>\cmd.exe' /c ""C:\Intel\drivers\$wdd.bat" /start"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ctfmon" /f