Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ChromeUpdate' = 'C:\ProgramData\ChromeUpdate\ChromeUpdate.exe'
- скрытых файлов
- C:\ProgramData\ChromeUpdate\ChromeUpdate.exe
- C:\ProgramData\ChromeUpdate\ChromeUpdate.exe
- 'ba##.#incoder.pro':80
- 'si###aloji.org':80
- 'wp#d':80
- si###aloji.org/botnet/server.php?ty##########
- si###aloji.org/botnet/server.php?ty########
- ba##.#incoder.pro/builder/config.php?ty###########
- wp#d/wpad.dat
- si###aloji.org/botnet/server.php?ty######
- DNS ASK ba##.#incoder.pro
- DNS ASK si###aloji.org
- DNS ASK wp#d