Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'KB01321295.exe' = '"%APPDATA%\KB01321295.exe"'
- %APPDATA%\KB01321295.exe
- <SYSTEM32>\cscript.exe
- %TEMP%\exp1.tmp.bat
- %APPDATA%\KB01321295.exe
- '20#.#23.154.130':8080
- '19#.#20.87.172':8080
- '20#.#13.98.131':8080
- '18#.#0.0.138':8080
- '66.##2.19.36':8080
- '85.##.147.73':8080
- '20#.#08.18.158':8080
- '82.##5.147.190':8080
- '17#.#24.208.60':8080
- '59.#0.221.6':8080
- '72.##7.253.106':8080
- '19#.#1.213.194':8080
- '21#.#55.134.110':8080
- '83.##8.208.55':8080
- '72.##.203.140':8080
- '20#.#72.140.202':8080
- ClassName: 'Indicator' WindowName: ''