Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'crome' = '%TEMP%\sub\office365.vbs'
- office365.exe
- %TEMP%\sub\office365.exe
- %TEMP%\sub\office365.vbs
- %TEMP%\sub\office365.exe
- http://ru######ointernational.com/cgi-bins/bin/98kksjh.bin
- DNS ASK ru######ointernational.com
- '%TEMP%\sub\office365.exe'
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%TEMP%\sub\office365.exe"