Техническая информация
- '%TEMP%\pupdmgr.exe'
- '%TEMP%\s1402.php'
- '%TEMP%\pwrmgr.exe'
- '%TEMP%\s1402.php' (загружен из сети Интернет)
- '%TEMP%\pwrmgr.exe' (загружен из сети Интернет)
- '%TEMP%\pupdmgr.exe' (загружен из сети Интернет)
- '<SYSTEM32>\cmd.exe' /c %TEMP%\s1402.php.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\pupdmgr.exe.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\pwrmgr.exe.bat
- %TEMP%\pupdmgr.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RWLjx1MCq3[1].exe
- %TEMP%\s1402.php.bat
- %TEMP%\s1402.php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\s1402[1].php
- %TEMP%\pwrmgr.exe.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\confirm[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sa2009[1].exe
- %TEMP%\pupdmgr.exe.bat
- %TEMP%\pwrmgr.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\confirm[1].php
- '78.##7.141.8':80
- 'vi#####cright---1.com':80
- '64.##7.39.247':80
- '77.##.225.234':80
- 78.##7.141.8/EX/RWLjx1MCq3.exe
- vi#####cright---1.com/s1402.php
- 64.##7.39.247/confirm.php?ai##############################################################################
- 77.##.225.234/soft/sa2009.exe
- DNS ASK vi#####cright---1.com