Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '%APPDATA%\Microsoft\Crypto\ape50qqg\rjvaojcl.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\2d83bp.exe
- %TEMP%\_mei46362\vcruntime140.dll
- %TEMP%\_mei46362\_bz2.pyd
- %TEMP%\_mei46362\_decimal.pyd
- %TEMP%\_mei46362\_hashlib.pyd
- %TEMP%\_mei46362\_lzma.pyd
- %TEMP%\_mei46362\_socket.pyd
- %TEMP%\_mei46362\_ssl.pyd
- %TEMP%\_mei46362\_uuid.pyd
- %TEMP%\_mei46362\base_library.zip
- %TEMP%\_mei46362\libcrypto-1_1.dll
- %TEMP%\_mei46362\libssl-1_1.dll
- %TEMP%\_mei46362\python39.dll
- %TEMP%\_mei46362\select.pyd
- %TEMP%\_mei46362\unicodedata.pyd
- %APPDATA%\microsoft\crypto\ape50qqg\rjvaojcl.exe
- %APPDATA%\microsoft\crypto\ape50qqg\rjvaojcl.exe
- DNS ASK t.#e
- DNS ASK ti##ok.com
- DNS ASK fa###ook.com
- DNS ASK if##nfig.me
- DNS ASK go###.org.ua
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%APPDATA%\Microsoft\Crypto\ape50qqg\rjvaojcl.exe"
- '<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Crypto\ape50qqg\rjvaojcl.exe"