Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\regasm.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- %HOMEPATH%\Desktop\filename.exe
- %TEMP%\Update.txt
- %APPDATA%\regasm.il
- %APPDATA%\regasm.pdb
- %APPDATA%\regasm.exe
- %TEMP%\passwordfox.exe
- %TEMP%\firefox.txt
- %TEMP%\iepv.exe
- %APPDATA%\regasm.pdb
- %APPDATA%\regasm.il
- %TEMP%\passwordfox.exe
- 'wp#d':80
- 'oi###ill.xyz':80
- http://11#.#11.111.1/wpad.dat via wp#d
- http://oi###ill.xyz/css/kc2/files/logs.php
- DNS ASK wp#d
- DNS ASK oi###ill.xyz
- '%HOMEPATH%\Desktop\filename.exe'
- '%APPDATA%\regasm.exe'
- '%TEMP%\passwordfox.exe' /stext %TEMP%\firefox.txt
- '%TEMP%\iepv.exe' /stext %TEMP%\ie.txt
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "%TEMP%\Update.txt" | cmd"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\regasm.il"