Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Copy Extensible Removal Propagation' = 'C:\neojxlebzf\lezavdk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\IKE Netlogon Foundation] 'ImagePath' = 'C:\neojxlebzf\lezavdk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\IKE Netlogon Foundation] 'Start' = '00000002'
- 'C:\neojxlebzf\gjyktovr.exe' "c:\neojxlebzf\lezavdk.exe"
- 'C:\neojxlebzf\lezavdk.exe'
- 'C:\neojxlebzf\q0if37rjjyssc3zchtk.exe'
- C:\neojxlebzf\lezavdk.exe
- C:\neojxlebzf\gjyktovr.exe
- C:\neojxlebzf\mzhlisjm
- %WINDIR%\neojxlebzf\dadlhm0uveth
- C:\neojxlebzf\dadlhm0uveth
- C:\neojxlebzf\q0if37rjjyssc3zchtk.exe
- C:\neojxlebzf\gjyktovr.exe
- C:\neojxlebzf\lezavdk.exe
- C:\neojxlebzf\q0if37rjjyssc3zchtk.exe
- %WINDIR%\neojxlebzf\dadlhm0uveth
- %WINDIR%\neojxlebzf\dadlhm0uveth
- '88.##.203.114':40413
- '95.##7.243.188':49038
- '81.##7.50.99':52074
- '18#.#0.220.30':25741
- '79.##1.239.74':42581
- '86.##.69.232':41590
- '17#.#40.117.149':27603
- '62.##.253.114':51156
- ClassName: 'Shell_TrayWnd' WindowName: ''