Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'twunk_64.exe' = '%WINDIR%\twunk_64.exe'
- %WINDIR%\twunk_64.exe
- 'ne#####ojan.no-ip.org':588
- 'ne#####ojan.no-ip.org':123
- 'ne#####ojan.no-ip.org':82
- 'ne#####ojan.no-ip.org':81
- 'any':588
- 'any':123
- 'any':82
- 'any':81
- DNS ASK ne#####ojan.no-ip.org