Техническая информация
- '%TEMP%\file__3.exe'
- %APPDATA%\secmod.db
- %TEMP%\sys_3\LY_LY3.exe
- %TEMP%\sys_2\LY_LY2.exe
- %APPDATA%\cert8.db
- %TEMP%\file__3.exe
- %APPDATA%\signons.sqlite
- %APPDATA%\key3.db
- 'sa####l-tours.com':80
- 'wp#d':80
- 'ma##.#ooq-libya.com':25
- http://sa####l-tours.com/wp-content/uploads/1.exe
- http://sa####l-tours.com/wp-content/uploads/2.exe
- http://11#.#11.111.2/wpad.dat via wp#d
- DNS ASK sa####l-tours.com
- DNS ASK wp#d
- DNS ASK ma##.#ooq-libya.com