Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\services\Media UserMode Program Management Telephony] 'Start' = '00000002'
- 'C:\fbwnqcj\hsvlkwgqkr.exe' "c:\fbwnqcj\uypfaftiw.exe"
- 'C:\fbwnqcj\uypfaftiw.exe'
- 'C:\fbwnqcj\r5d4a7xnhtilxwzqmjg.exe'
- C:\fbwnqcj\uypfaftiw.exe
- C:\fbwnqcj\hsvlkwgqkr.exe
- C:\fbwnqcj\zwccjwc
- %WINDIR%\fbwnqcj\adq2sqy8qe
- C:\fbwnqcj\adq2sqy8qe
- C:\fbwnqcj\r5d4a7xnhtilxwzqmjg.exe
- C:\fbwnqcj\hsvlkwgqkr.exe
- C:\fbwnqcj\uypfaftiw.exe
- C:\fbwnqcj\r5d4a7xnhtilxwzqmjg.exe
- %WINDIR%\fbwnqcj\adq2sqy8qe
- DNS ASK pl####ntspring.net
- DNS ASK ne####aryfound.net
- DNS ASK ne####aryspring.net
- DNS ASK ne#####rysuccess.net
- DNS ASK pl####ntsuccess.net
- DNS ASK pl####ntfound.net
- DNS ASK he####uccess.net
- DNS ASK di#####ltsuccess.net
- DNS ASK dn#.##ftncsi.com
- DNS ASK he###banker.net
- DNS ASK di####ultbanker.net
- ClassName: 'Shell_TrayWnd' WindowName: ''