Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winscn' = '<SYSTEM32>:winscn.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{CEC302CA-0597-E799-07B8-4CF042D8B9AE}] 'StubPath' = '<SYSTEM32>:winscn.exe'
- '%WINDIR%\33736.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>:winscn.exe
- %WINDIR%\33736.exe
- %WINDIR%\33736.exe
- 'da####123.no-ip.biz':3460
- DNS ASK da####123.no-ip.biz
- ClassName: 'AutoHotkey' WindowName: '<Полный путь к вирусу>'