Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Razer Drivers' = '%APPDATA%\Razercore.exe'
- %WINDIR%\syswow64\explorer.exe
- %TEMP%\autf488.tmp
- %APPDATA%\userlog.dat
- %TEMP%\user2.txt
- %TEMP%\532149
- %TEMP%\autdee.tmp
- %TEMP%\autdde.tmp
- %TEMP%\72266
- %TEMP%\autdcd.tmp
- %TEMP%\user7
- nul
- %APPDATA%\razercore.exe
- %TEMP%\791576
- %TEMP%\incl2
- %TEMP%\autf4a9.tmp
- %TEMP%\incl1
- %TEMP%\autf4a8.tmp
- %TEMP%\32389
- %TEMP%\85.bat
- %TEMP%\user8
- %APPDATA%\razercore.exe
- %APPDATA%\userlog.dat
- %TEMP%\autf488.tmp
- %TEMP%\autf4a8.tmp
- %TEMP%\autf4a9.tmp
- %TEMP%\791576
- %TEMP%\autdcd.tmp
- %TEMP%\autdde.tmp
- %TEMP%\autdee.tmp
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- DNS ASK cy####ot1.ddns.net
- ClassName: 'Progman' WindowName: ''
- '%APPDATA%\razercore.exe'
- '%APPDATA%\razercore.exe' /AutoIt3ExecuteScript "%TEMP%\532149" "%APPDATA%\Razercore.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\85.bat' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\85.bat
- '%WINDIR%\syswow64\ping.exe' -n 0127.0.0.1
- '%WINDIR%\syswow64\explorer.exe'