Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'NONORDINATIONA' = '%HOMEPATH%\andreau\PEYOTYLDECIM.exe'
- ieinstal.exe
- %HOMEPATH%\andreau\peyotyldecim.exe
- 'so####rion.com.ar':443
- 'pr######usmoney.duckdns.org':5270
- DNS ASK so####rion.com.ar
- DNS ASK pr######usmoney.duckdns.org
- '::####:224.0.0.252':5355
- '%ProgramFiles(x86)%\internet explorer\ieinstal.exe'