Техническая информация
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- %APPDATA%\tyhgfds.exe
- %TEMP%\tgrfedc.txt
- %PROGRAMDATA%\tsvxoyer\8372422.txt
- %PROGRAMDATA%\tsvxoyer\files\_information.txt
- %PROGRAMDATA%\tsvxoyer\46173476.txt
- %PROGRAMDATA%\tsvxoyer\nl_2020_06_11___00_09___wjfpy_95.211.190.199.zip
- %PROGRAMDATA%\tsvxoyer\46173476.txt
- %PROGRAMDATA%\tsvxoyer\8372422.txt
- %APPDATA%\tyhgfds.exe
- http://rr###ad02.top/download.php?fi########
- http://rr###ad02.top/downfiles/6.exe
- http://ip##pi.com/line/
- http://ip##pi.com/line
- DNS ASK rr###ad02.top
- DNS ASK ip##pi.com
- DNS ASK ip###ger.org
- DNS ASK 2n#.co
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '<Полный путь к файлу>'
- '%APPDATA%\tyhgfds.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\tsvxoyer & timeout 2 & del /f /q "%APPDATA%\tyhgfds.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\tsvxoyer & timeout 2 & del /f /q "%APPDATA%\tyhgfds.exe"
- '%WINDIR%\syswow64\timeout.exe' 2