Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\b553651e4b86f0564af6327d8b6e3b5317f1ef31.lnk
- C:\intosaves\slqqo1153kowisgsd1xi.exe
- C:\intosaves\2rjh2a7qeddbbcjrnsjgybxfwcy6f3.vbs
- C:\intosaves\qpcamtb3gkkbwu9bdeio9ynuw9ossu.bat
- C:\intosaves\7w0z5etwoij5zwdod17lrgcc7e0tlo.bat
- C:\intosaves\vmcheck32.dll
- C:\intosaves\minecraft.exe
- C:\intosaves\system.vbe
- C:\intosaves\system.lnk
- C:\intosaves\b553651e4b86f0564af6327d8b6e3b5317f1ef31.lnk
- http://qy############urfafwfolxheolgr.000webhostapp.com/wmcd1o7xjes9j6f71avzqr7zna8s3zujn4y060hd/s3m7kzin02f96kljnupaoffz/0816aa12464a506305006a13ac15ad8c037cdd11.php?ce########################...
- DNS ASK qy############urfafwfolxheolgr.000webhostapp.com
- ClassName: 'EDIT' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' "C:\intosaves\2rjH2a7QedDBBCJRNSJGYBXfwCY6f3.vbs"
- 'C:\intosaves\slqqo1153kowisgsd1xi.exe' -p151b165ceca266ed9164f72d626176a8c589720b
- '%WINDIR%\syswow64\wscript.exe' "C:\intosaves\System.vbe"
- 'C:\intosaves\minecraft.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\QpcamtB3GkKBwu9bdEiO9ynUW9oSSU.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\7w0Z5etWoij5ZwDod17lRgcc7E0tLO.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\QpcamtB3GkKBwu9bdEiO9ynUW9oSSU.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\7w0Z5etWoij5ZwDod17lRgcc7E0tLO.bat" "