Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'yfzmdxhrfvmz' = '%ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.exe'
- %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.exe
- %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\jli.dll
- %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\msvcr100.dll
- %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.txt
- %LOCALAPPDATA%\178bfbff000406f1
- %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\key
- '43.##8.37.192':8080
- '43.##8.37.192':12345
- http://43.###.37.192:8080/9x.dll via 43.##8.37.192
- '43.##8.37.192':12345
- '%ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.exe'
- '%WINDIR%\syswow64\cmd.exe' /c start %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.exe' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c md %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c md %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn
- '%WINDIR%\syswow64\cmd.exe' /c start %ALLUSERSPROFILE%\qryflzjdqkosvzdgkorvycgjnruycfjn\yfzmdxhrfvmz.exe