Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\adobedngconverter.lnk
- %TEMP%\scrptzqe.bat
- C:\users\public\documents\jpejgkfohmaq.ini
- %APPDATA%\jpejgkfohmaq.bat
- %TEMP%\fs.vbs
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000
- DNS ASK ca####abrasil.com
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- '<SYSTEM32>\cscript.exe' %TEMP%\fS.vbs
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\sCrPTzQE.bat"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\sCrPTzQE.bat"
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
- '<SYSTEM32>\cmd.exe' /c start %APPDATA%\jpejgkfohmaq.bat
- '<SYSTEM32>\cmd.exe' /K %APPDATA%\jpejgkfohmaq.bat
- '<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776
- '<SYSTEM32>\timeout.exe' /t 10
- '<SYSTEM32>\shutdown.exe' /r /t 0