Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd3dx32' = 'C:\systemWOW32\System.lnk'
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\bkphst32.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\winlog.lnk
- C:\systemwow32\yhbmukkhmnxv9a7eh1uc.exe
- C:\systemwow32\psueedgmuz3hdkdo4ydjqvjvxi7tng.vbs
- C:\systemwow32\txejhvcgfnoctb3o5xivqjudxgtbxi.bat
- C:\systemwow32\nfmfkxkl5zuy8yiwxx2l8hi8dg0pyv.bat
- C:\systemwow32\vmcheck32.dll
- C:\systemwow32\fontreview.exe
- C:\systemwow32\system.vbe
- C:\systemwow32\system.lnk
- %HOMEPATH%\pictures\bkphst32.exe
- %HOMEPATH%\pictures\bkphst32.lnk
- %HOMEPATH%\pictures\vmcheck32.dll
- C:\systemwow32\winlog.lnk
- DNS ASK vk##oup.tk
- ClassName: 'EDIT' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' "C:\systemWOW32\pSueeDGmUz3hDkdO4yDjQVJVxi7TNg.vbs"
- 'C:\systemwow32\yhbmukkhmnxv9a7eh1uc.exe' -p6467193aa65699e631c9510ee6fec46e05cb85c7
- '%WINDIR%\syswow64\wscript.exe' "C:\systemWOW32\System.vbe"
- 'C:\systemwow32\fontreview.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\tXeJhvCGfnoCTb3o5XivqJuDXGTBxi.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\nfmFkxkl5ZUY8yiWXx2L8hi8DG0pYV.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\tXeJhvCGfnoCTb3o5XivqJuDXGTBxi.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\nfmFkxkl5ZUY8yiWXx2L8hi8DG0pYV.bat" "