Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'SecurityWIN64' = 'Wscript.exe "%APPDATA%\windows.vbs"'
- '<SYSTEM32>\ping.exe' -n 1 www.su####atorybr.com
- '<SYSTEM32>\wscript.exe' "%APPDATA%\windows.vbs"
- %ALLUSERSPROFILE%\user.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\comphp[1].php
- %TEMP%\8973.tmp
- %TEMP%\7905.tmp
- %ALLUSERSPROFILE%\ppctrl.dat
- %APPDATA%\windows.vbs
- %ALLUSERSPROFILE%\pckt.tmp
- %ALLUSERSPROFILE%\MZђ
- %TEMP%\3111.tmp
- %ALLUSERSPROFILE%\ppctrl.dat
- %APPDATA%\windows.vbs
- %TEMP%\8973.tmp
- %TEMP%\7905.tmp
- %TEMP%\3111.tmp
- '19#.#36.58.14':80
- 'localhost':1038
- 'www.su####atorybr.com':80
- 19#.#36.58.14/comphp.php?ti#######################################
- www.su####atorybr.com/bit/a.php?a=#####
- www.su####atorybr.com/bisupdpck.txt
- www.su####atorybr.com/bisdtpck.txt
- DNS ASK www.su####atorybr.com