Техническая информация
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'a1aJ0' = '%APPDATA%\dtj5j\0NGSr36l_e5ufeu04b\a1aJ0.exe'
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\a1aj0.txt
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\a1aj0.exe
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\discord-rpc.x86.dll
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\steam_api.dll
- %LOCALAPPDATA%\1fcbfbff000406f1
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\.lnk
- %APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\.lnk
- '13#.#20.134.214':8080
- '13#.#20.134.214':12345
- http://13#.###.134.214:8080/10x.dll via 13#.#20.134.214
- '13#.#20.134.214':12345
- ClassName: '' WindowName: ''
- '%APPDATA%\dtj5j\0ngsr36l_e5ufeu04b\a1aj0.exe'
- '<Полный путь к файлу>' 410238025E02570271026702700271025E0277027102670270025E0243027202720246026302760263025E0250026D0263026F026B026C0265025E02660276026802370268025E0232024C02450251027002310234026E025D026702370277026... (со скрытым окном)