Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{N2DCSDFK-ZIQP-R29X-6XYY-XOQOQS12HV24}' = '"%APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8...
- %APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\config.json
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\z9pmdpek\x32r[1].crp
- %APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\cryptsp.exe
- %APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\config.json
- %APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\cryptsp.exe
- из <Полный путь к файлу> в %APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\kbdax2.exe
- 'yi#.su':443
- '10#.#80.48.68':21
- '10#.#80.48.68':50128
- '10#.#80.48.68':50380
- 'we###nero.com':5533
- DNS ASK yi#.su
- DNS ASK we###nero.com
- '%APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\cryptsp.exe'
- '%APPDATA%\amd64_microsoft-windows-wlancoinstaller_31bf3856ad364e35_6.1.7600.16385_none_aab0e8a1758f24f7\cryptsp.exe' ' (со скрытым окном)