Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4f871e1b030c4278ac703b4a386e973c' = '%HOMEPATH%\4f871e1b030c4278ac703b4a386e973c\38XxV9O'
- %HOMEPATH%\4f871e1b030c4278ac703b4a386e973c\38xxv9o.exe
- %HOMEPATH%\4f871e1b030c4278ac703b4a386e973c\zboiju38.exe
- http://if##nfig.me/ip
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://cl###dclub.pro/b/kmkWuwOr9hoZa/4f871e1b030c4278ac703b4a386e973c
- http://cl###dclub.pro/b/9dZlN9rN5BRQs8U8/4f871e1b030c4278ac703b4a386e973c
- DNS ASK if##nfig.me
- DNS ASK ap#.#pdata.co
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK cl###dclub.pro
- '%HOMEPATH%\4f871e1b030c4278ac703b4a386e973c\38xxv9o.exe' 4f871e1b030c4278ac703b4a386e973c http://cl###dclub.pro 38XxV9O
- '%HOMEPATH%\4f871e1b030c4278ac703b4a386e973c\zboiju38.exe' 4f871e1b030c4278ac703b4a386e973c http://cl###dclub.pro