Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Aoirlq iaucya] 'ImagePath' = '%WINDIR%\Terms.EXE'
- [<HKLM>\SYSTEM\ControlSet001\Services\Aoirlq iaucya] 'Start' = '00000002'
- '<SYSTEM32>\wscript.exe' "C:\9500.vbs"
- '%WINDIR%\Terms.EXE'
- C:\9500.vbs
- %WINDIR%\Terms.EXE
- C:\9500.vbs
- 'localhost':1040
- 'ky####ng.f3322.net':8080
- DNS ASK ky####ng.f3322.net