Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'KOLOGER' = '%TEMP%\Gellan\EXCITATI.vbs'
- excitati.exe
- %TEMP%\ori-2.0.exe
- %TEMP%\gellan\excitati.exe
- %TEMP%\gellan\excitati.vbs
- http://18#.#05.209.166/wext/ori-2.0.exe
- http://18#.#05.209.166/wext/Rem-Stub21_xJNEDiadS140.bin
- '%TEMP%\gellan\excitati.exe'