Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mls' = '"%APPDATA%\RAC\mls.exe" -s'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svcsc.exe' = '%APPDATA%\RAC\svcsc.exe'
- %TEMP%\82010382.tmp
- <Drive name for removable media>:\hanni_umami_chapter.exe
- %TEMP%\2283910379.tmp
- %TEMP%\rcxbd55.tmp
- %TEMP%\82010382.tmp
- %TEMP%\rcxbe8e.tmp
- %TEMP%\rcxbf1c.tmp
- %TEMP%\rcxbfa9.tmp
- %TEMP%\29710392.tmp
- %TEMP%\82010382.tmp
- from %TEMP%\rcxbd55.tmp to %TEMP%\2283910379.tmp
- from %TEMP%\2283910379.tmp to %APPDATA%\rac\mls.exe
- from %TEMP%\rcxbe8e.tmp to %TEMP%\82010382.tmp
- from %TEMP%\rcxbf1c.tmp to %TEMP%\82010382.tmp
- from %TEMP%\rcxbfa9.tmp to %TEMP%\82010382.tmp
- 'wx###lytics.ru':80
- http://wx###lytics.ru/net.exe.config
- http://wx###lytics.ru/net.exe
- DNS ASK wx###lytics.ru