Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mls' = '"%APPDATA%\RAC\mls.exe" -s'
- %TEMP%\141998651.tmp
- %TEMP%\rcxa1da.tmp
- from %TEMP%\rcxa1da.tmp to %TEMP%\141998651.tmp
- from %TEMP%\141998651.tmp to %APPDATA%\rac\mls.exe
- %TEMP%\141998651.tmp
- 'wx###lytics.ru':80
- http://wx###lytics.ru/net.exe.config
- DNS ASK wx###lytics.ru