Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7' = '%ALLUSERSPROFILE%\2t844t1043x...
- %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7.exe
- %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\libcef.dll
- %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7.txt
- %LOCALAPPDATA%\178bfbff000406f1
- %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\key
- %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\key
- '82.##7.12.41':8080
- '82.##7.12.41':12345
- http://82.###.12.41:8080/8X/client.dll via 82.##7.12.41
- '82.##7.12.41':12345
- '%ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7.exe'
- '%WINDIR%\syswow64\cmd.exe' /c start %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7.exe' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c start %ALLUSERSPROFILE%\2t844t1043xl69xl88g8c4ak88ryf1e76wh22t2v0p9k4p769t1y03k5w\55526i3541z44f7d392xngb2d3jyzub3843q6638obtw304w41m5u3b8t0vr637ght53c7sa7.exe