Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Rqxopr Rnfmjffe Cby] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\aspnet_sate] 'Start' = '00000002'
- %WINDIR%\Temp\Jbcdefghi_NET.exe
- %WINDIR%\Temp\Qkkfidtng_NET.exe
- %WINDIR%\Temp\FF_Server.exe
- <SYSTEM32>\svchost.exe -k imgsvc
- <SYSTEM32>\svchost.exe -k netsvcs
- C:\system64.log
- C:\WinWall64.bmp
- C:\1322400.dll
- %PROGRAM_FILES%\Omwh\Uaoxajgyl.bmp
- C:\Net-Temp.ini
- %CommonProgramFiles%\main.jpg
- %WINDIR%\Temp\Qkkfidtng_NET.exe
- %WINDIR%\Temp\Jbcdefghi_NET.exe
- %WINDIR%\Temp\FF_Server.exe
- C:\NT_Path.jpg
- C:\3149900.dll
- <SYSTEM32>\firefox.exe
- %PROGRAM_FILES%\Omwh\Uaoxajgyl.bmp
- C:\WinWall64.bmp
- C:\3149900.dll
- C:\1322400.dll
- %WINDIR%\Temp\Jbcdefghi_NET.exe
- C:\Net-Temp.ini
- C:\system64.log
- %WINDIR%\Temp\Qkkfidtng_NET.exe
- C:\NT_Path.jpg
- 'we##918.com':9999
- 'ww##.#ikiplum.com':9999
- DNS ASK we##918.com
- DNS ASK ww##.#ikiplum.com