Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvggxxzhicfjwk' = '<SYSTEM32>\Rundll32.exe "<SYSTEM32>\hqlbszcrllpnynq.dll" EntryPoint'
- %TEMP%\nsuc255.tmp
- %TEMP%\nsfc295.tmp\system.dll
- %WINDIR%\syswow64\hqlbszcrllpnynq.dll
- %WINDIR%\syswow64\vvyvxygnptavhsdgn.exe
- %TEMP%\nsfc295.tmp\nsisdl.dll
- %TEMP%\nsfc295.tmp\nsisdl.dll
- %TEMP%\nsfc295.tmp\system.dll
- DNS ASK ad#.##nbanner.com
- ClassName: '#32770' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\rundll32.exe' "<SYSTEM32>\hqlbszcrllpnynq.dll" EntryPoint