Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Iwfiaq dmckew] 'Start' = '00000002'
- '%WINDIR%\Terms.EXE'
- 'C:\Qxfloy.exe'
- '<SYSTEM32>\wscript.exe' "C:\6920.vbs"
- '<SYSTEM32>\wscript.exe' "C:\7479.vbs"
- %WINDIR%\Terms.EXE
- C:\6920.vbs
- C:\Qxfloy.exe
- C:\7479.vbs
- C:\6920.vbs
- C:\Qxfloy.exe
- C:\7479.vbs
- 'localhost':2012
- '58.##1.60.171':2014