Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Movingbat' = '"%APPDATA%\Movingbat.exe"'
- addinprocess32.exe
- %APPDATA%\movingbat.exe
- %TEMP%\addinprocess32.exe
- 'bing.com':443
- 'pa###bin.com':443
- 'bing.com':443
- 'pa###bin.com':443
- DNS ASK bing.com
- DNS ASK pa###bin.com
- '%TEMP%\addinprocess32.exe'