Техническая информация
- %WINDIR%\Tasks\{880AD88D-132F-126D-6DC6-E95B2D98EC03}.job
- %WINDIR%\Tasks\{F9059B64-4EAE-2CCF-0B23-585B06B22947}.job
- [<HKLM>\SYSTEM\ControlSet001\Services\BITS] 'Start' = '00000002'
- '%TEMP%\33767227.t.exe' /install
- '<SYSTEM32>\regsvr32.exe' /s /n /i:"/in" "%ALLUSERSPROFILE%\Application Data\907d0dd3\dc2aee48.dll" /S:vpLNZ1_lgahJD_8IuNYPwMmcEmjMqTlJytCu9nvPM9l8h8MP04FDxf46-g0yCz_kaX3jPhVn_wBwSBvdjUivVIaT3JW1wHjk1MPiC4xATLSvZRKcbZuv...
- %ALLUSERSPROFILE%\Application Data\907d0dd3\dc2aee48.dll
- %ALLUSERSPROFILE%\Application Data\{FE8679C5-492D-CE6E-4581-9C414ACF88B2}\5EAD475C-E906-F0F7-8D48-03360F0AABD7.exe
- %TEMP%\33767227.t.exe
- <Полный путь к файлу> в %TEMP%\{004af69e}
- 'br####alizer.info':80
- 'localhost':1047
- 'dy#.com':80
- 'za##i.info':80
- 'bu####setter.info':80
- 'bl###iller.info':80
- 'localhost':1039
- 'wp#d':80
- 'www.ho###ator.com':80
- 'le##a.info':80
- 'ye##s.net':80
- 'li###ool.info':80
- http://11#.#11.111.2/wpad.dat via wp#d
- http://za##i.info/rp/?er#######
- http://bu####setter.info/u/
- http://le##a.info/rp/
- DNS ASK br####alizer.info
- DNS ASK dy#.com
- DNS ASK bl###iller.info
- DNS ASK za##i.info
- DNS ASK bu####setter.info
- DNS ASK wp#d
- DNS ASK www.ho###ator.com
- DNS ASK li###ool.info
- DNS ASK le##a.info
- DNS ASK ye##s.net