Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd3dx32' = 'C:\Media\System.lnk'
- %HOMEPATH%\start menu\programs\startup\system.lnk
- C:\media\ealyzu6fywdmeuxfxncq.exe
- C:\media\mjcalpm6jvvieohogvvise3wvgtqao.vbs
- C:\media\wo29cefsii4cwawslugdlmwmv0y1mq.bat
- C:\media\fbzrjyrwwrwgrpcncyd7ftewnarkkw.bat
- C:\media\vmcheck32.dll
- C:\media\fontreview.exe
- C:\media\system.vbe
- C:\media\system.lnk
- %HOMEPATH%\my documents\my pictures\bkphst32.exe
- DNS ASK qw###3.space
- DNS ASK ip##fo.io
- ClassName: 'EDIT' WindowName: ''
- '<SYSTEM32>\wscript.exe' "C:\Media\mJCALPM6JvviEOhOGVViSE3wvGtqao.vbs"
- 'C:\media\ealyzu6fywdmeuxfxncq.exe' -p82fe7c636ccd7be7a30fb77e05867b276f263aca
- '<SYSTEM32>\wscript.exe' "C:\Media\System.vbe"
- 'C:\media\fontreview.exe'
- '<SYSTEM32>\cmd.exe' /c ""C:\Media\Wo29cEfsIi4cWawSLUGDlMWMV0y1mQ.bat" "' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ""C:\Media\FbZRjYRwwRwGrPCNcyD7FtEwnaRkkW.bat" "' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ""C:\Media\Wo29cEfsIi4cWawSLUGDlMWMV0y1mQ.bat" "
- '<SYSTEM32>\cmd.exe' /c ""C:\Media\FbZRjYRwwRwGrPCNcyD7FtEwnaRkkW.bat" "