Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'VFXGNxv++pP' = '<LS_APPDATA>\Microsoft\Windows\sjylbhn.exe'
- '<SYSTEM32>\svchost.exe'
- <SYSTEM32>\svchost.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\QWRsN2srdjlxUUdDYVp0aTBMUzl2K2V1bWR2MFVuUXl1ei9NUDQ0N09EZ0JyMlpTbGVuWStvQml5aHhIYXcvZStSMVpIQkJRZmRiSmliZGVuS1hmVGE5S3B1WW1TQkVrdmd2NnpJTlQ4QQ==[1]
- %TEMP%\rotgnozrh.tmp
- <LS_APPDATA>\Microsoft\Windows\sjylbhn.exe
- %TEMP%\rotgnozrh.tmp
- 'ft###gdwhrc.com':80
- ft###gdwhrc.com/QWRsN2srdjlxUUdDYVp0aTBMUzl2K2V1bWR2MFVuUXl1ei9NUDQ0N09EZ0JyMlpTbGVuWStvQml5aHhIYXcvZStSMVpIQkJRZmRiSmliZGVuS1hmVGE5S3B1WW1TQkVrdmd2NnpJTlQ4QQ==
- ft###gdwhrc.com/
- DNS ASK ft###gdwhrc.com
- ClassName: 'Indicator' WindowName: '(null)'