Техническая информация
- %WINDIR%\Tasks\{51970553-3813-42F1-D446-646FF733A85A}.job
- '%APPDATA%\ihMwJAzg\GhdqAXsZ\xIpscsmS\ZCWaWUfbO.exe'
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
- [<HKCU>\Software\Microsoft\messengerservice]
- %APPDATA%\ihMwJAzg\GhdqAXsZ\xIpscsmS\ZCWaWUfbO.exe
- 'fi##.##ellarquest.us':80
- 'fi##.#ouwprofs.com':80
- 'vo####kudrac.mobi':80
- http://fi##.##ellarquest.us/scan.php
- http://fi##.#ouwprofs.com/scan.php
- http://vo####kudrac.mobi/scan.php
- DNS ASK fi##.##ellarquest.us
- DNS ASK fi##.#ouwprofs.com
- DNS ASK vo####kudrac.mobi