Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
- '%TEMP%\IXP000.TMP\GgEb.exe' cIgNT
- '%APPDATA%\636090202371093750.exe'
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
- [<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
- [<HKCU>\Software\Valve\Steam]
- %TEMP%\IXP000.TMP\cIgNT
- %TEMP%\IXP000.TMP\GgEb.exe
- %APPDATA%\636090202371093750.exe
- 'ko####mboo.ddns.net':4107
- 'cs###chance.in':80
- 'wp#d':80
- http://11#.#11.111.1/wpad.dat via wp#d
- http://cs###chance.in/index.php
- DNS ASK ko####mboo.ddns.net
- DNS ASK cs###chance.in
- DNS ASK wp#d