Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '%APPDATA%\Microsoft\Crypto\fsqb9r97\0xjs6abf.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\vkj7xx.exe
- %TEMP%\_mei52962\vcruntime140.dll
- %TEMP%\_mei52962\_bz2.pyd
- %TEMP%\_mei52962\_decimal.pyd
- %TEMP%\_mei52962\_hashlib.pyd
- %TEMP%\_mei52962\_lzma.pyd
- %TEMP%\_mei52962\_socket.pyd
- %TEMP%\_mei52962\_ssl.pyd
- %TEMP%\_mei52962\_uuid.pyd
- %TEMP%\_mei52962\base_library.zip
- %TEMP%\_mei52962\libcrypto-1_1.dll
- %TEMP%\_mei52962\libssl-1_1.dll
- %TEMP%\_mei52962\python39.dll
- %TEMP%\_mei52962\select.pyd
- %TEMP%\_mei52962\unicodedata.pyd
- %APPDATA%\microsoft\crypto\fsqb9r97\0xjs6abf.exe
- %APPDATA%\microsoft\crypto\fsqb9r97\0xjs6abf.exe
- DNS ASK t.#e
- DNS ASK ti##ok.com
- DNS ASK fa###ook.com
- DNS ASK go###.org.ua
- DNS ASK if##nfig.me
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%APPDATA%\Microsoft\Crypto\fsqb9r97\0xjs6abf.exe"
- '<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Crypto\fsqb9r97\0xjs6abf.exe"