Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\aszjh] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\hzdgzb] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\kbssux.exe' = '<SYSTEM32>\kbssux.exe:*:Enabled:Microsoft (R) Internetal IExplore'
- '<SYSTEM32>\eeosec.exe'
- '<SYSTEM32>\kbssux.exe'
- '%TEMP%\13biz.exe'
- '%TEMP%\13blz.exe'
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\hfblddel.bat" "
- <SYSTEM32>\eeosec.exe
- <SYSTEM32>\kbssux.exe
- <SYSTEM32>\hfblddel.bat
- %TEMP%\13biz.exe
- %TEMP%\13blz.exe
- %TEMP%\13blz.exe
- %TEMP%\13biz.exe
- 'any':8888
- 'any':13
- DNS ASK an##.myftp.org
- DNS ASK al####r.no-ip.biz