Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'font2' = '%PROGRAMDATA%\font2Files\rekeywiz.exe'
- %TEMP%\policy guidelines for online classes.pdf
- %TEMP%\erfudqgveqn6g.hta
- %PROGRAMDATA%\font2files\rekeywiz.exe
- %PROGRAMDATA%\font2files\duser.dll
- %PROGRAMDATA%\font2files\nuo7v4.tmp
- %PROGRAMDATA%\font2files\rekeywiz.exe.config
- %TEMP%\erfudqgveqn6g.hta
- http://www.au####.km01s.net/plugins/16914/11662/true/true/
- http://www.au####.km01s.net/cgi/8ee4d36866/16914/11662/eeef4361/file.hta
- DNS ASK au####.km01s.net
- '%PROGRAMDATA%\font2files\rekeywiz.exe'
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\Policy Guidelines for Online Classes.pdf"
- '%WINDIR%\syswow64\mshta.exe' %TEMP%\eRFudQgvEQN6g.hta