Техническая информация
- '<SYSTEM32>\notepad.exe' %TEMP%\Password.txt
- '%TEMP%\updateworker.exe'
- %TEMP%\password.txt
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\updateworker.exe
- http://bi#.ly/3eaY1TH
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK bi#.ly
- DNS ASK ra#.####ubusercontent.com