Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\tweak update.lnk
- 'C:\Users\%USERNAME%\AppData\Local\Temp\svchost.exe' -a quark -o stratum+tcp://obfuscode.net:3354 -u nskythe.1 -p x -t 2
- 'C:\Users\%USERNAME%\AppData\Local\Temp\keygen server.exe'
- '<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ztmp\t5314.bat" "
- C:\Users\%USERNAME%\AppData\Local\Temp\keygen server.exe
- %TEMP%\ztmp\t5314.bat
- %TEMP%\ztmp\t5363.exe
- C:\Users\%USERNAME%\AppData\Local\Temp\zlib1.dll
- C:\Users\%USERNAME%\AppData\Local\Temp\libcurl.dll
- C:\Users\%USERNAME%\AppData\Local\Temp\pthreadGC2.dll
- C:\Users\%USERNAME%\AppData\Local\Temp\svchost.exe
- 'ob###code.net':3354
- DNS ASK ob###code.net
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'