Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TcpIpCfg' = 'Rundll32 "%APPDATA%\pbbnevu.dll" MainThread'
- '<SYSTEM32>\rundll32.exe' "%APPDATA%\pbbnevu.dll" MainThread
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
- %APPDATA%\pbbnevu.dll
- %APPDATA%\pbbnevu.dll
- 'www.ka###tbt.com':80
- 'localhost':1038
- '67.##5.160.76':80
- www.ka###tbt.com/get.asp?MA###############
- 67.##5.160.76/
- DNS ASK www.ku###aouk.com
- DNS ASK www.ya##o.com
- DNS ASK www.ka###tbt.com
- ClassName: 'Indicator' WindowName: '(null)'