Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Updates' = '%APPDATA%\data\control.exe'
- '%APPDATA%\data\svhost.exe'
- %TEMP%\evb2.tmp
- %TEMP%\evb3.tmp
- %TEMP%\evb1.tmp
- %APPDATA%\data\svhost.exe
- %APPDATA%\data\control.exe
- 'aa###aaa18.pw':80
- 'wp#d':80
- aa###aaa18.pw/miner.txt
- wp#d/wpad.dat
- DNS ASK aa###aaa18.pw
- DNS ASK wp#d
- ClassName: 'Indicator' WindowName: '(null)'