Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\services\Assistant Cryptographic Propagation Agent] 'Start' = '00000002'
- 'C:\rirfvpdsij\tetvzpfk.exe' "c:\rirfvpdsij\pavrwfwwkn.exe"
- 'C:\rirfvpdsij\pavrwfwwkn.exe'
- 'C:\rirfvpdsij\vm8c94ezzaoeuoxdx.exe'
- C:\rirfvpdsij\pavrwfwwkn.exe
- C:\rirfvpdsij\tetvzpfk.exe
- C:\rirfvpdsij\whxvrcrl
- %WINDIR%\rirfvpdsij\hmvoplyitkae
- C:\rirfvpdsij\hmvoplyitkae
- C:\rirfvpdsij\vm8c94ezzaoeuoxdx.exe
- C:\rirfvpdsij\tetvzpfk.exe
- C:\rirfvpdsij\pavrwfwwkn.exe
- C:\rirfvpdsij\vm8c94ezzaoeuoxdx.exe
- %WINDIR%\rirfvpdsij\hmvoplyitkae
- DNS ASK ne####aryfound.net
- DNS ASK pl####ntfound.net
- DNS ASK pl####ntspring.net
- DNS ASK pl####ntsuccess.net
- DNS ASK ne####aryspring.net
- DNS ASK he###banker.net
- DNS ASK dn#.##ftncsi.com
- DNS ASK he###spring.net
- DNS ASK di#####ltsuccess.net
- DNS ASK di####ultbanker.net
- DNS ASK he####uccess.net
- ClassName: 'Shell_TrayWnd' WindowName: ''