Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\SkCZj6bte8.dll'
- <SYSTEM32>\SkCZj6bte8.dll
- 'gu##oxyz.tk':80
- 'localhost':1038
- http://gu##oxyz.tk/download/dllpbfree9797455/zlib1.dll
- DNS ASK gu##oxyz.tk
- '<SYSTEM32>\cmd.exe' /c color C
- '<SYSTEM32>\cmd.exe' /c CLS