Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'j04jDOtUVcZv0eDUUn' = '%APPDATA%\072v8f42prN4mm3Q\IhjkxTR1Xc8r.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'j04jDOtUVcZv0eDU' = '%APPDATA%\072v8f42prN4mm3Q\swdv1DwdTf50.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\083fe1f6eb8be47153476a8a81a5197e.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Wiindows.exe' = '%TEMP%\Wiindows.exe:*:Enabled:Wiindows.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Wiindows.exe" "Wiindows.exe" ENABLE
- '%TEMP%\Wiindows.exe'
- '%TEMP%\office.exe'
- %APPDATA%\072v8f42prN4mm3Q\swdv1DwdTf50.exe
- %TEMP%\Wiindows.exe
- %APPDATA%\072v8f42prN4mm3Q\IhjkxTR1Xc8r.exe
- %TEMP%\KMSAuto Net.exe
- %TEMP%\aut1.tmp
- %TEMP%\office.exe
- %TEMP%\aut2.tmp
- %APPDATA%\072v8f42prN4mm3Q\IhjkxTR1Xc8r.exe
- %APPDATA%\072v8f42prN4mm3Q\swdv1DwdTf50.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- 'bn####4.myftp.biz':13135
- DNS ASK bn####4.myftp.biz
- ClassName: 'Shell_TrayWnd' WindowName: ''