Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\f408235ca86aed9c3cd83140423232e1
- C:\driverdll\8chjhcqts2kobqt3gyqv.exe
- C:\driverdll\wn8a6cxjgmequ9dwuxflzxoe5on5my.vbs
- C:\driverdll\hfbw1uf7axqno1ap7baf5vxvnmxpf0.bat
- C:\driverdll\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- C:\driverdll\msg.vbs
- C:\driverdll\mos
- C:\driverdll\sizqzwnegkgkdftffjchaai9xfd9sq.bat
- C:\driverdll\vmcheck32.dll
- C:\driverdll\savesdriver.exe
- C:\driverdll\system.vbe
- C:\driverdll\system.lnk
- http://ov##.#####869.pr46m.vps.myjino.ru/5licpu7m3fh8zj/q4g6p5tzlr1ib9yajy626824wz0zp3iva66vtglopj1e35odrwx7ndnehubanht0pz2qigyavsbel/ce20b368fcc01d48989382baa5cb3f363c5e2e9c.php?22############...
- DNS ASK ov##.#####869.pr46m.vps.myjino.ru
- ClassName: 'EDIT' WindowName: ''
- '%WINDIR%\syswow64\wscript.exe' "C:\driverdll\Wn8a6cXjGmeQu9DWuXfLZxoE5ON5My.vbs"
- 'C:\driverdll\8chjhcqts2kobqt3gyqv.exe' -p4309149222d0519d3b193378d2a4a7ff73a4758f
- '%WINDIR%\syswow64\wscript.exe' "C:\driverdll\System.vbe"
- '%WINDIR%\syswow64\wscript.exe' "C:\driverdll\msg.vbs"
- 'C:\driverdll\savesdriver.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\driverdll\HfbW1uf7AxQno1AP7baf5vXVNMXPF0.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\driverdll\SIzqZwnEgkgKdFTFfJchaAI9XFD9sq.bat" "' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\driverdll\HfbW1uf7AxQno1AP7baf5vXVNMXPF0.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\driverdll\SIzqZwnEgkgKdFTFfJchaAI9XFD9sq.bat" "