Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mls' = '"%APPDATA%\RAC\mls.exe" -s'
- %TEMP%\366914600.tmp
- <Drive name for removable media>:\february_catalogue__2015.exe
- %TEMP%\2621214587.tmp
- %TEMP%\rcx6670.tmp
- %TEMP%\rcx66fd.tmp
- <PATH_SAMPLE>.doc
- %TEMP%\366914600.tmp
- %TEMP%\rcx7464.tmp
- %TEMP%\rcx7520.tmp
- %TEMP%\rcx759e.tmp
- %TEMP%\262414619.tmp
- <PATH_SAMPLE>.doc
- %TEMP%\366914600.tmp
- from %TEMP%\rcx6670.tmp to %TEMP%\2621214587.tmp
- from %TEMP%\rcx66fd.tmp to %TEMP%\2621214587.tmp
- from %TEMP%\2621214587.tmp to %APPDATA%\rac\mls.exe
- from %TEMP%\rcx7464.tmp to %TEMP%\366914600.tmp
- from %TEMP%\rcx7520.tmp to %TEMP%\366914600.tmp
- from %TEMP%\rcx759e.tmp to %TEMP%\366914600.tmp
- DNS ASK wx###lytics.ru
- '%APPDATA%\rac\mls.exe' -s
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.doc"' (with hidden window)
- '%APPDATA%\rac\mls.exe' -s' (with hidden window)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "<PATH_SAMPLE>.doc"