Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uURSXCuxkj' = 'C:\Users\Public\uURSXCuxkj.vbs'
- host.exe
- %APPDATA%\tieringengineservice\imtclnwz.bat
- C:\users\public\uursxcuxkj.vbs
- %APPDATA%\install\host.exe
- %APPDATA%\install\host.exe
- DNS ASK ma######copy.duckdns.org
- '%APPDATA%\install\host.exe'