Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '*aJd6Xzi' = ''
- <SYSTEM32>\rundll32.exe "%HOMEPATH%\Local Settings\vHlXtuOZ\ogZQmz8S.JQz",HFF8
- <SYSTEM32>\cscript.exe
- <Служебный элемент>
- <SYSTEM32>\ctfmon.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\rundll32.exe
- %HOMEPATH%\Local Settings\vHlXtuOZ\e082CPeWfePev3HpeCWhp_ehp5W.ZJ1
- %HOMEPATH%\Local Settings\vHlXtuOZ\e082CPeWfvPev3HpeCWh3ff53R5.ZJ1
- %HOMEPATH%\Local Settings\vHlXtuOZ\fW-YDsLn.FYs
- %HOMEPATH%\Local Settings\vHlXtuOZ\ogZQmz8S.JQz
- %HOMEPATH%\Local Settings\vHlXtuOZ\kepR8Go9.qRG
- '17#.#9.146.167':80
- 'wp#d':80
- wp#d/wpad.dat
- 17#.#9.146.167/
- DNS ASK wp#d
- ClassName: 'Indicator' WindowName: ''