Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mls' = '"%APPDATA%\RAC\mls.exe" -s'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svcsc.exe' = '%APPDATA%\RAC\svcsc.exe'
- %TEMP%\1831426453.tmp
- <Drive name for removable media>:\508softwareandos.exe
- %TEMP%\1726826473.tmp
- <Drive name for removable media>:\applicantform_en.exe
- %TEMP%\1831426453.tmp
- %TEMP%\rcxfe5b.tmp
- %TEMP%\rcxff36.tmp
- %TEMP%\rcxff75.tmp
- %TEMP%\rcxffa5.tmp
- %TEMP%\1726826473.tmp
- %TEMP%\rcx170d.tmp
- %TEMP%\rcx173c.tmp
- %TEMP%\rcx178b.tmp
- %TEMP%\2749426486.tmp
- %TEMP%\1831426453.tmp
- %TEMP%\1726826473.tmp
- from %TEMP%\rcxfe5b.tmp to %TEMP%\1831426453.tmp
- from %TEMP%\1831426453.tmp to %APPDATA%\rac\mls.exe
- from %TEMP%\rcxff75.tmp to %TEMP%\1831426453.tmp
- from %TEMP%\rcxffa5.tmp to %TEMP%\1831426453.tmp
- from %TEMP%\rcx170d.tmp to %TEMP%\1726826473.tmp
- from %TEMP%\rcx173c.tmp to %TEMP%\1726826473.tmp
- from %TEMP%\rcx178b.tmp to %TEMP%\1726826473.tmp
- %TEMP%\1831426453.tmp
- 'wx###lytics.ru':80
- http://wx###lytics.ru/net.exe.config
- DNS ASK wx###lytics.ru