Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Eifwok owovky] 'Start' = '00000002'
- 'C:\Eiuqqk.exe'
- '%WINDIR%\Bwyoace.exe'
- '%TEMP%\RarSFX0\uharc.exe' e file.uha
- '%TEMP%\RarSFX0\ms.exe'
- '<SYSTEM32>\wscript.exe' "C:\3586.vbs"
- C:\Eiuqqk.exe
- %WINDIR%\Bwyoace.exe
- C:\3586.vbs
- %TEMP%\RarSFX0\uharc.exe
- %TEMP%\RarSFX0\file.uha
- %TEMP%\RarSFX0\ms.exe
- C:\Eiuqqk.exe
- C:\3586.vbs
- %TEMP%\RarSFX0\uharc.exe
- %TEMP%\RarSFX0\file.uha
- %TEMP%\RarSFX0\ms.exe
- 'localhost':2012
- 'xi####ai01.3322.org':2012
- DNS ASK xi####ai01.3322.org
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'