Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\msscenter] 'Start' = '00000002'
- <SYSTEM32>\msscntr32.exe
- <SYSTEM32>\cmd.exe /c """%TEMP%\_tmp32.bat"" "
- %TEMP%\_tmp32.bat
- %WINDIR%\s32.txt
- <SYSTEM32>\msscntr32.exe
- '20#.#17.170.42':80
- '66.##7.233.133':80
- 20#.#17.170.42/forum_asp.php
- 66.##7.233.133/forum_asp.php