Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Profile Update Reporting RPC Removal IP' = '%APPDATA%\n0kjueehrlj0\kdrkcqzz6.exe'
- %APPDATA%\n0kjueehrlj0\kdrkcqzz6.exe
- %APPDATA%\n0kjueehrlj0\v9x0uh5iyx.exe
- %APPDATA%\n0kjueehrlj0\kdrkcqzz6.c0js
- %APPDATA%\n0kjueehrlj0\kdrkcqzz6.exe
- %APPDATA%\n0kjueehrlj0\v9x0uh5iyx.exe
- DNS ASK re####erorderly.net
- DNS ASK ri####chance.net
- DNS ASK li#####nderstood.net
- DNS ASK de#####understood.net
- DNS ASK li####twenty.net
- DNS ASK de####ytwenty.net
- DNS ASK li####meeting.net
- DNS ASK de####ymeeting.net
- DNS ASK li####chance.net
- DNS ASK de####ychance.net
- DNS ASK hu#####understood.net
- DNS ASK jo#####understood.net
- DNS ASK hu####dtwenty.net
- DNS ASK jo####ytwenty.net
- DNS ASK hu####dmeeting.net
- DNS ASK jo####ymeeting.net
- DNS ASK hu####dchance.net
- DNS ASK jo####ychance.net
- DNS ASK re####ervalue.net
- DNS ASK wo###value.net
- DNS ASK be####chance.net
- DNS ASK ri####meeting.net
- '%APPDATA%\n0kjueehrlj0\kdrkcqzz6.exe'
- '%APPDATA%\n0kjueehrlj0\v9x0uh5iyx.exe' "%APPDATA%\n0kjueehrlj0\kdrkcqzz6.exe"