Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DHCP Propagation Registry WMI Reports Location' = 'C:\gojuenshq\bsugfeucwu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Resource Encrypting Foundation Class Video] 'ImagePath' = 'C:\gojuenshq\bsugfeucwu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Resource Encrypting Foundation Class Video] 'Start' = '00000002'
- 'C:\gojuenshq\trboazfa.exe' "c:\gojuenshq\bsugfeucwu.exe"
- 'C:\gojuenshq\bsugfeucwu.exe'
- 'C:\gojuenshq\iewv2i58lmbjnsgop5y.exe'
- C:\gojuenshq\bsugfeucwu.exe
- C:\gojuenshq\trboazfa.exe
- C:\gojuenshq\iewv2i58lmbjnsgop5y.exe
- %WINDIR%\gojuenshq\bbcmgr2ulxgf
- C:\gojuenshq\bbcmgr2ulxgf
- C:\gojuenshq\trboazfa.exe
- C:\gojuenshq\bsugfeucwu.exe
- C:\gojuenshq\iewv2i58lmbjnsgop5y.exe
- %WINDIR%\gojuenshq\bbcmgr2ulxgf
- %WINDIR%\gojuenshq\bbcmgr2ulxgf
- 'st####thopinion.net':80
- 'st####thpromise.net':80
- 'st####thshort.net':80
- 'de####promise.net':80
- 'st####thshould.net':80
- 'mo####ntsupply.net':80
- 'mo####ntoffice.net':80
- 'ou####eoffice.net':80
- 'ou####edistance.net':80
- 'ou####esupply.net':80
- 'mo#####tdistance.net':80
- 're####promise.net':80
- 'pr####eshould.net':80
- 'br####promise.net':80
- 'br####opinion.net':80
- 're####opinion.net':80
- 'de####should.net':80
- 'de####opinion.net':80
- 'pr####epromise.net':80
- 'pr####eopinion.net':80
- 'pr####eshort.net':80
- 'de###eshort.net':80
- 'st###office.net':80
- 'mi###office.net':80
- 'mi####istance.net':80
- 'mi###supply.net':80
- 'st####istance.net':80
- 'st###arrive.net':80
- 'do####distance.net':80
- 'pr####distance.net':80
- 'pr####supply.net':80
- 'mi###arrive.net':80
- 'do####supply.net':80
- 'ev####gsupply.net':80
- 'bu#####gdistance.net':80
- 'bu####ngsupply.net':80
- 'mo####ntarrive.net':80
- 'ou####earrive.net':80
- 'ev####gdistance.net':80
- 'ev####garrive.net':80
- 'st###supply.net':80
- 'bu####ngarrive.net':80
- 'bu####ngoffice.net':80
- 'ev####goffice.net':80
- 're###tshort.net':80
- 'bu####ngshort.net':80
- 'ev####gshort.net':80
- 'ev####gshould.net':80
- 'ou####epromise.net':80
- 'bu####ngshould.net':80
- 'bu####ngopinion.net':80
- 'st###should.net':80
- 'mi###should.net':80
- 'ev####gpromise.net':80
- 'ev####gopinion.net':80
- 'bu####ngpromise.net':80
- 'ma#####ldifferent.net':80
- 'mo####ntshould.net':80
- 'se#####different.net':80
- 'se####lletter.net':80
- 'ma####alletter.net':80
- 'ou####eshould.net':80
- 'ou####eopinion.net':80
- 'mo####ntpromise.net':80
- 'mo####ntopinion.net':80
- 'mo####ntshort.net':80
- 'ou####eshort.net':80
- 'fe####should.net':80
- 'fe###wshort.net':80
- 'pr####promise.net':80
- 'pr####opinion.net':80
- 'do####promise.net':80
- 'do###eshort.net':80
- 're####should.net':80
- 'br###nshort.net':80
- 'br####should.net':80
- 'fe####opinion.net':80
- 'fe####promise.net':80
- 'mi####pinion.net':80
- 'st####romise.net':80
- 'st####pinion.net':80
- 'st###short.net':80
- 'mi###short.net':80
- 'mi####romise.net':80
- 'pr###yshort.net':80
- 'do####opinion.net':80
- 'do###rshort.net':80
- 'do####should.net':80
- 'pr####should.net':80
- http://st####thopinion.net/index.php
- http://st####thpromise.net/index.php
- http://st####thshort.net/index.php
- http://de####promise.net/index.php
- http://st####thshould.net/index.php
- http://mo####ntsupply.net/index.php
- http://mo####ntoffice.net/index.php
- http://ou####eoffice.net/index.php
- http://ou####edistance.net/index.php
- http://ou####esupply.net/index.php
- http://mo#####tdistance.net/index.php
- http://re####promise.net/index.php
- http://pr####eshould.net/index.php
- http://br####promise.net/index.php
- http://br####opinion.net/index.php
- http://re####opinion.net/index.php
- http://de####should.net/index.php
- http://de####opinion.net/index.php
- http://pr####epromise.net/index.php
- http://pr####eopinion.net/index.php
- http://pr####eshort.net/index.php
- http://de###eshort.net/index.php
- http://st###office.net/index.php
- http://mi###office.net/index.php
- http://mi####istance.net/index.php
- http://mi###supply.net/index.php
- http://st####istance.net/index.php
- http://st###arrive.net/index.php
- http://do####distance.net/index.php
- http://pr####distance.net/index.php
- http://pr####supply.net/index.php
- http://mi###arrive.net/index.php
- http://do####supply.net/index.php
- http://ev####gsupply.net/index.php
- http://bu#####gdistance.net/index.php
- http://bu####ngsupply.net/index.php
- http://mo####ntarrive.net/index.php
- http://ou####earrive.net/index.php
- http://ev####gdistance.net/index.php
- http://ev####garrive.net/index.php
- http://st###supply.net/index.php
- http://bu####ngarrive.net/index.php
- http://bu####ngoffice.net/index.php
- http://ev####goffice.net/index.php
- http://re###tshort.net/index.php
- http://bu####ngshort.net/index.php
- http://ev####gshort.net/index.php
- http://ev####gshould.net/index.php
- http://ou####epromise.net/index.php
- http://bu####ngshould.net/index.php
- http://bu####ngopinion.net/index.php
- http://st###should.net/index.php
- http://mi###should.net/index.php
- http://ev####gpromise.net/index.php
- http://ev####gopinion.net/index.php
- http://bu####ngpromise.net/index.php
- http://ma#####ldifferent.net/index.php
- http://mo####ntshould.net/index.php
- http://se#####different.net/index.php
- http://se####lletter.net/index.php
- http://ma####alletter.net/index.php
- http://ou####eshould.net/index.php
- http://ou####eopinion.net/index.php
- http://mo####ntpromise.net/index.php
- http://mo####ntopinion.net/index.php
- http://mo####ntshort.net/index.php
- http://ou####eshort.net/index.php
- http://fe####should.net/index.php
- http://fe###wshort.net/index.php
- http://pr####promise.net/index.php
- http://pr####opinion.net/index.php
- http://do####promise.net/index.php
- http://do###eshort.net/index.php
- http://re####should.net/index.php
- http://br###nshort.net/index.php
- http://br####should.net/index.php
- http://fe####opinion.net/index.php
- http://fe####promise.net/index.php
- http://mi####pinion.net/index.php
- http://st####romise.net/index.php
- http://st####pinion.net/index.php
- http://st###short.net/index.php
- http://mi###short.net/index.php
- http://mi####romise.net/index.php
- http://pr###yshort.net/index.php
- http://do####opinion.net/index.php
- http://do###rshort.net/index.php
- http://do####should.net/index.php
- http://pr####should.net/index.php
- DNS ASK st####thopinion.net
- DNS ASK st####thpromise.net
- DNS ASK st####thshort.net
- DNS ASK de####promise.net
- DNS ASK st####thshould.net
- DNS ASK mo####ntsupply.net
- DNS ASK mo####ntoffice.net
- DNS ASK ou####eoffice.net
- DNS ASK ou####edistance.net
- DNS ASK ou####esupply.net
- DNS ASK mo#####tdistance.net
- DNS ASK re####promise.net
- DNS ASK pr####eshould.net
- DNS ASK br####promise.net
- DNS ASK br####opinion.net
- DNS ASK re####opinion.net
- DNS ASK de####should.net
- DNS ASK de####opinion.net
- DNS ASK pr####epromise.net
- DNS ASK pr####eopinion.net
- DNS ASK pr####eshort.net
- DNS ASK de###eshort.net
- DNS ASK st###office.net
- DNS ASK mi###office.net
- DNS ASK mi####istance.net
- DNS ASK mi###supply.net
- DNS ASK st####istance.net
- DNS ASK st###arrive.net
- DNS ASK do####distance.net
- DNS ASK pr####distance.net
- DNS ASK pr####supply.net
- DNS ASK mi###arrive.net
- DNS ASK do####supply.net
- DNS ASK ev####gsupply.net
- DNS ASK bu#####gdistance.net
- DNS ASK bu####ngsupply.net
- DNS ASK mo####ntarrive.net
- DNS ASK ou####earrive.net
- DNS ASK ev####gdistance.net
- DNS ASK ev####garrive.net
- DNS ASK st###supply.net
- DNS ASK bu####ngarrive.net
- DNS ASK bu####ngoffice.net
- DNS ASK ev####goffice.net
- DNS ASK re###tshort.net
- DNS ASK bu####ngshort.net
- DNS ASK ev####gshort.net
- DNS ASK ev####gshould.net
- DNS ASK ou####epromise.net
- DNS ASK bu####ngshould.net
- DNS ASK bu####ngopinion.net
- DNS ASK st###should.net
- DNS ASK mi###should.net
- DNS ASK ev####gpromise.net
- DNS ASK ev####gopinion.net
- DNS ASK bu####ngpromise.net
- DNS ASK ma#####ldifferent.net
- DNS ASK mo####ntshould.net
- DNS ASK se#####different.net
- DNS ASK se####lletter.net
- DNS ASK ma####alletter.net
- DNS ASK ou####eshould.net
- DNS ASK ou####eopinion.net
- DNS ASK mo####ntpromise.net
- DNS ASK mo####ntopinion.net
- DNS ASK mo####ntshort.net
- DNS ASK ou####eshort.net
- DNS ASK fe####should.net
- DNS ASK fe###wshort.net
- DNS ASK pr####promise.net
- DNS ASK pr####opinion.net
- DNS ASK do####promise.net
- DNS ASK do###eshort.net
- DNS ASK re####should.net
- DNS ASK br###nshort.net
- DNS ASK br####should.net
- DNS ASK fe####opinion.net
- DNS ASK fe####promise.net
- DNS ASK mi####pinion.net
- DNS ASK st####romise.net
- DNS ASK st####pinion.net
- DNS ASK st###short.net
- DNS ASK mi###short.net
- DNS ASK mi####romise.net
- DNS ASK pr###yshort.net
- DNS ASK do####opinion.net
- DNS ASK do###rshort.net
- DNS ASK do####should.net
- DNS ASK pr####should.net
- ClassName: 'Shell_TrayWnd' WindowName: ''