Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'sqlwriter' = '"<LS_APPDATA>\sqlwriter.exe"'
- %TEMP%\ziptmp.zip
- %TEMP%\Temporary Directory 1 for ziptmp.zip\Patch_DownLoadLy.iR.exe
- %TEMP%\Patch_DownLoadLy.iR.exe
- %WINDIR%\tfadxp62.txt
- <LS_APPDATA>\ziptmp.zip
- %TEMP%\Temporary Directory 2 for ziptmp.zip\sqlwriter.exe
- <LS_APPDATA>\sqlwriter.exe
- %TEMP%\ziptmp.zip
- %WINDIR%\tfadxp62.txt
- <LS_APPDATA>\ziptmp.zip
- '20#.#6.232.182':80
- '<LOCALNET>.0.236':2306
- 'ae#1.tk':2306
- 'ae#2.tk':2306
- 'ae#3.tk':2306
- 'ae#7.tk':2306
- 'ae#8.tk':2306
- 'ae#9.tk':2306
- 'ae##0.tk':2306
- DNS ASK www.microsoft.com
- DNS ASK ae#1.tk
- DNS ASK ae#2.tk
- DNS ASK ae#3.tk
- DNS ASK ae#4.tk
- DNS ASK ae#5.tk
- DNS ASK ae#7.tk
- DNS ASK ae#8.tk
- DNS ASK ae#9.tk
- DNS ASK ae##0.tk
- '%TEMP%\Patch_DownLoadLy.iR.exe'
- '<LS_APPDATA>\sqlwriter.exe'