Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}' = 'yxfhcjpg.dll'
- '<SYSTEM32>\zxfhajpg.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\~DFD390421.bat
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\zxfhajpg.exe
- %TEMP%\~DFD390421.bat
- <SYSTEM32>\xzfhbjpg.sys
- <SYSTEM32>\yxfhcjpg.dll
- <SYSTEM32>\xzfhbjpg.sys
- <SYSTEM32>\yxfhcjpg.dll
- <SYSTEM32>\zxfhajpg.exe