Техническая информация
- [<HKLM>\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'kissq' = '%HOMEPATH%\AppData\Lo'
- %WINDIR%\explorer.exe
- %TEMP%\jfiag_gg.exe
- %TEMP%\fjgha23_fa.txt
- %TEMP%\kissq.exe
- %TEMP%\ecv9f39.tmp
- http://ip##pi.com/json/
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt' (со скрытым окном)
- '<SYSTEM32>\devicecensus.exe' UserCxt