Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Wsyses mqywosky] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Wsyses mqywosky] 'ImagePath' = '%ProgramFiles(x86)%\Microsoft Ahrgew\Kaqikkm.exe'
- 'Wsyses mqywosky' %ProgramFiles(x86)%\Microsoft Ahrgew\Kaqikkm.exe
- %ProgramFiles(x86)%\microsoft ahrgew\kaqikkm.exe
- C:\5094.vbs
- C:\5094.vbs
- 'xw####.f3322.org':2014
- DNS ASK xw####.f3322.org
- '%ProgramFiles(x86)%\microsoft ahrgew\kaqikkm.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\5094.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\5094.vbs"' (со скрытым окном)