Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- %HOMEPATH%\Start Menu\Programs\Startup\bATYPdaBWKiS.lnk
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
- %TEMP%\IXP000.TMP\PLNJI
- %TEMP%\aut2.tmp
- %APPDATA%\PLNJI
- %APPDATA%\CVGe.exe
- %TEMP%\IXP000.TMP\CTHTND~1.EXE
- %APPDATA%\636567277982031250.exe
- %TEMP%\IXP000.TMP\CVGe.exe
- %TEMP%\aut1.tmp
- %HOMEPATH%\IaLEnqx3QReAIecI\PLNJI
- %HOMEPATH%\IaLEnqx3QReAIecI\CVGe.exe
- %TEMP%\IXP000.TMP\CVGe.exe
- %TEMP%\IXP000.TMP\PLNJI
- %TEMP%\IXP000.TMP\CTHTND~1.EXE
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %APPDATA%\CVGe.exe в %HOMEPATH%\IaLEnqx3QReAIecI\CVGe.exe
- %APPDATA%\PLNJI в %HOMEPATH%\IaLEnqx3QReAIecI\PLNJI
- 'cs###unbets.com':80
- 'wp#d':80
- http://11#.#11.111.1/wpad.dat via wp#d
- http://cs###unbets.com/api/upload.php
- DNS ASK cs###unbets.com
- DNS ASK wp#d
- '%APPDATA%\CVGe.exe' "%APPDATA%\PLNJI"
- '%TEMP%\IXP000.TMP\CTHTND~1.EXE'
- '%APPDATA%\636567277982031250.exe'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'