Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Thread Reporting PnP-X Encryption Machine Plug' = '%APPDATA%\gjqwyalunchx\xpshwdmuy.exe'
- '%APPDATA%\gjqwyalunchx\tzgceejb.exe' "%APPDATA%\gjqwyalunchx\xpshwdmuy.exe"
- '%APPDATA%\gjqwyalunchx\xpshwdmuy.exe'
- %APPDATA%\gjqwyalunchx\xpshwdmuy.vpxqb
- %APPDATA%\gjqwyalunchx\tzgceejb.exe
- %APPDATA%\gjqwyalunchx\xpshwdmuy.exe
- %APPDATA%\gjqwyalunchx\xpshwdmuy.exe
- 'am####explain.net':80
- 'we####rinstead.net':80
- am####explain.net/index.php?em###########################################
- we####rinstead.net/index.php?em###########################################
- DNS ASK am####bright.net
- DNS ASK we####rbright.net
- DNS ASK am####inside.net
- DNS ASK we####rinstead.net
- DNS ASK am####explain.net
- DNS ASK we####rexplain.net
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'