Техническая информация
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '2jzsV' = '%APPDATA%\alsfqelajf\mV63y3Dati_mfDlss\2jzsV.exe'
- %APPDATA%\alsfqelajf\mv63y3dati_mfdlss\2jzsv.txt
- %APPDATA%\alsfqelajf\mv63y3dati_mfdlss\2jzsv.exe
- %APPDATA%\alsfqelajf\mv63y3dati_mfdlss\360p2sp.dll
- %APPDATA%\alsfqelajf\mv63y3dati_mfdlss\11p2sp.dll
- %LOCALAPPDATA%\1fcbfbff000406f1
- %APPDATA%\alsfqelajf\mv63y3dati_mfdlss\key
- 'mo#####.map.fastly.net':443
- '15#.#01.82.106':8080
- '15#.#01.82.106':12345
- http://15#.##1.82.106:8080/9x.dll via 15#.#01.82.106
- '15#.#01.82.106':12345
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- '%APPDATA%\alsfqelajf\mv63y3dati_mfdlss\2jzsv.exe'
- '<Полный путь к файлу>' 46053F055905500576056005770576055905700576056005770559054405750575054105640571056405590557056A05640568056C056B0562055905640569057605630574056005690564056F056305590568055305330536057C05360541056... (со скрытым окном)