Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gqxRqe' = '%APPDATA%\gqxRqe\gqxRqe.exe'
- <SYSTEM32>\tasks\updates\wlwbhdgyxe
- '%APPDATA%\microsoft\windows\templates\fmxxdift.exe'
- fmxxdift.exe
- %APPDATA%\microsoft\windows\templates\fmxxdift.exe
- %APPDATA%\wlwbhdgyxe.exe
- %TEMP%\tmp5ba6.tmp
- %APPDATA%\gqxrqe\gqxrqe.exe
- %APPDATA%\wlwbhdgyxe.exe
- %TEMP%\tmp5ba6.tmp
- 'sr###.com.mx':80
- DNS ASK sr###.com.mx
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\WlwbHDGYXE" /XML "%TEMP%\tmp5BA6.tmp"' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\WlwbHDGYXE" /XML "%TEMP%\tmp5BA6.tmp"