Техническая информация
- [<HKLM>\SYSTEM\ControlSet002\Services\qdbjim] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet003\Services\qdbjim] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\yhvmjwun] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\qdbjim] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\mhvmjw] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet002\Services\mhvmjw] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet003\Services\mhvmjw] 'Start' = '00000002'
- %TEMP%\liyong.exe
- %TEMP%\1.exe
- %TEMP%\Йс№нґт№ЦРЎЦъКЦ.exe
- %TEMP%\q.exe
- <SYSTEM32>\svchost.exe -k qdbjim
- <SYSTEM32>\svchost.exe -k mhvmjw
- NtQueryDirectoryFile, драйвер-обработчик: kwyovv.sys
- NtDeviceIoControlFile, драйвер-обработчик: kwyovv.sys
- %TEMP%\1.exe
- <DRIVERS>\kwyovv.sys
- <SYSTEM32>\rjuyyx.fsl
- <SYSTEM32>\4a1d5.imj
- <SYSTEM32>\kwyovv.dll
- %TEMP%\q.exe
- %TEMP%\Йс№нґт№ЦРЎЦъКЦ.exe
- <SYSTEM32>\00053da4.ini
- %TEMP%\liyong.exe
- %TEMP%\liyong.exe
- %TEMP%\q.exe
- 'an###c.3322.org':3030
- 'll###9.3322.org':3030
- DNS ASK an###c.3322.org
- DNS ASK ll###9.3322.org
- '<IP-адрес в локальной сети>':1035
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''