Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'KB01321295.exe' = '"%APPDATA%\KB01321295.exe"'
- %APPDATA%\KB01321295.exe
- <SYSTEM32>\cscript.exe
- %TEMP%\exp1.tmp.bat
- %APPDATA%\KB01321295.exe
- '21#.#4.197.66':8080
- '41.##8.5.140':8080
- '18#.#0.0.138':8080
- '21#.#7.171.186':8080
- '59.#0.221.6':8080
- '21#.#6.23.100':8080
- '85.##4.204.32':8080
- '21#.#4.250.173':8080
- '12#.#9.103.198':8080
- '19#.#1.107.70':8080
- ClassName: 'Indicator' WindowName: ''