Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '<LS_APPDATA>\Microsoft\Windows\BsBhvScan.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1680e9fa7b4dd5d62ece800239bb53bd' = '%ALLUSERSPROFILE%\Application Data\Important.exe'
- '<LS_APPDATA>\Microsoft\Windows\bthserv.exe'
- '<LS_APPDATA>\Microsoft\Windows\BsBhvScan.exe'
- bthserv.exe
- [<HKCU>\Software\IMVU\username]
- %ALLUSERSPROFILE%\Application Data\Important.exe
- %ALLUSERSPROFILE%\Application Data\CRNJEUFU_3_19_18_57_1.jpg
- <LS_APPDATA>\Microsoft\Windows\bthserv.exe
- <LS_APPDATA>\Microsoft\Windows\BsBhvScan.exe
- <LS_APPDATA>\Microsoft\Windows\BsBhvScan.exe
- <LS_APPDATA>\Microsoft\Windows\bthserv.exe
- 'www.ra####ashion.online':80
- 'wp#d':80
- http://www.ra####ashion.online/tutorial/basety/post.php?ty##########################################################
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK www.ra####ashion.online
- DNS ASK wp#d