Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TcpIpCfg' = 'Rundll32 "%APPDATA%\eoyxykj.dll" MainThread'
- '<SYSTEM32>\rundll32.exe' "%APPDATA%\eoyxykj.dll" MainThread
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
- %APPDATA%\ini.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ini2[1].txt
- %APPDATA%\eoyxykj.dll
- %APPDATA%\eoyxykj.dll
- 'www.he###pop.com':80
- 'www.ku###aouk.com':80
- '67.##5.160.76':80
- 'localhost':1039
- www.ku###aouk.com/ini2.txt?kt#####
- www.he###pop.com/get.asp?MA############
- 67.##5.160.76/
- DNS ASK www.ku###aouk.com
- DNS ASK www.he###pop.com
- DNS ASK www.ya##o.com
- ClassName: 'Indicator' WindowName: '(null)'