Техническая информация
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\ZnVmZdD.dll,DllRegisterServer
- %WINDIR%\syswow64\msiexec.exe
- %PROGRAMDATA%\znvmzdd.dll
- %APPDATA%\ydkoo\oqof.dll
- http://wm######xxbcxmucxmlc.com/files/april14.dll
- http://wm######xxbcxmucxmlc.com/post.php
- http://oj######lftfkkuxxiqd.com/post.php
- DNS ASK wm######xxbcxmucxmlc.com
- DNS ASK oj######lftfkkuxxiqd.com
- DNS ASK pw######tsshkoibaake.com
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\ZnVmZdD.dll,DllRegisterServer' (со скрытым окном)
- '%WINDIR%\syswow64\msiexec.exe'