Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'HOPLIT' = '%TEMP%\UPBOULEVA\Prereco5.vbs'
- prereco5.exe
- %TEMP%\upbouleva\prereco5.exe
- %TEMP%\upbouleva\prereco5.vbs
- http://gr###cavi.net/a1/007_cTFNr251.bin
- DNS ASK gr###cavi.net
- '%TEMP%\upbouleva\prereco5.exe'