Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Vwxyab Defghijk Mno] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Vwxyab Defghijk Mno] 'ImagePath' = '%WINDIR%\zqbzqy.exe'
- 'Vwxyab Defghijk Mno' %WINDIR%\zqbzqy.exe
- %WINDIR%\server.dll
- %WINDIR%\zqbzqy.exe
- 'mi#.#hinaz.com':80
- '22#.#73.123.2':9874
- '10#.#14.171.125':2077
- '10#.#14.171.125':2077
- DNS ASK mi#.#hinaz.com
- ClassName: 'CTXOPConntion_Class' WindowName: ''
- '%WINDIR%\zqbzqy.exe'
- '%WINDIR%\zqbzqy.exe' Win7