Техническая информация
- '<SYSTEM32>\at.exe'
- autoit3.exe
- %TEMP%\ixp000.tmp\development.a3x
- %TEMP%\ixp000.tmp\autoit3.exe
- %TEMP%\ixp000.tmp\autoit3.exe
- %TEMP%\ixp000.tmp\development.a3x
- '17#.#5.144.127':80
- http://17#.#5.144.127/312b423bf6dd463f8d15.php
- DNS ASK WI###########XPWZJqtQq.WISpPaehoETDlXPWZJqtQq
- DNS ASK microsoft.com
- '%TEMP%\ixp000.tmp\autoit3.exe' Development.a3x
- '%TEMP%\ixp000.tmp\autoit3.exe'
- '<SYSTEM32>\at.exe' (со скрытым окном)
- '%TEMP%\ixp000.tmp\autoit3.exe' Development.a3x (со скрытым окном)