Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '%APPDATA%\Microsoft\Crypto\w1ia6sps\otv6kwm6.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\8l2w1y.exe
- %TEMP%\_mei21042\vcruntime140.dll
- %TEMP%\_mei21042\_bz2.pyd
- %TEMP%\_mei21042\_decimal.pyd
- %TEMP%\_mei21042\_hashlib.pyd
- %TEMP%\_mei21042\_lzma.pyd
- %TEMP%\_mei21042\_socket.pyd
- %TEMP%\_mei21042\_ssl.pyd
- %TEMP%\_mei21042\_uuid.pyd
- %TEMP%\_mei21042\base_library.zip
- %TEMP%\_mei21042\libcrypto-1_1.dll
- %TEMP%\_mei21042\libssl-1_1.dll
- %TEMP%\_mei21042\python39.dll
- %TEMP%\_mei21042\select.pyd
- %TEMP%\_mei21042\unicodedata.pyd
- %APPDATA%\microsoft\crypto\w1ia6sps\otv6kwm6.exe
- %APPDATA%\microsoft\crypto\w1ia6sps\otv6kwm6.exe
- DNS ASK t.#e
- DNS ASK ti##ok.com
- DNS ASK fa###ook.com
- DNS ASK if##nfig.me
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%APPDATA%\Microsoft\Crypto\w1ia6sps\otv6kwm6.exe"
- '<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Crypto\w1ia6sps\otv6kwm6.exe"