Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{A0448C4B-3C0D-AEA1-4811-D95B5FDCCC03}] 'StubPath' = '<SYSTEM32>\winspare.exe'
- %APPDATA%\winupdate.exe
- <SYSTEM32>\winspare.exe
- %APPDATA%\winupdate.exe
- %APPDATA%\tmp.doc
- %APPDATA%\winupdate.exe
- 'ne####hod.myvnc.com':8000
- 'so#####are.myvnc.com':443
- 'ne####hod.myvnc.com':443
- DNS ASK so#####are.myvnc.com
- DNS ASK ne####hod.myvnc.com
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''