Техническая информация
- %WINDIR%\Tasks\At1.job
- [<HKLM>\SYSTEM\ControlSet001\Services\sr] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\wphhppqo] 'Start' = '00000002'
- Компонент восстановления системы (SR)
- <SYSTEM32>\at.exe 16:58:00 /every:Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday "<SYSTEM32>\rundll32.exe" "<SYSTEM32>\qgzxzyxs.dll",DllMain -
- <SYSTEM32>\rundll32.exe "<SYSTEM32>\qgzxzyxs.dll",DllMain
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\winlogon.exe
- firefox.exe
- iexplore.exe
- <SYSTEM32>\qgzxzyxs.dll
- %TEMP%\nsa2.tmp
- <SYSTEM32>\Restore\MachineGuid.txt
- DNS ASK fi###elect.com
- DNS ASK lo###-ip.com
- DNS ASK ib###alue.net
- DNS ASK sa####-domain.info
- DNS ASK tr####ecurity.com
- '<IP-адрес в локальной сети>':1037
- '<IP-адрес в локальной сети>':1036