Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Cdefgh Jklmnopq Stu] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Cdefgh Jklmnopq Stu] 'ImagePath' = '<SYSTEM32>\svchost.exe -k imgsvc'
- C:\map771500.dll
- C:\heygirl.ddd
- C:\nettemp.ini
- %ProgramFiles(x86)%\hdef\dtuvwxyab.jpg
- C:\nettemp.ini
- C:\nettemp.ini
- DNS ASK 0.###.ngrok.io
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Hdef\Dtuvwxyab.jpg", MerCedes