Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{90359234-04B2-4A5D-A8D9-F34B82327F64}' = 'hook dll rising'
- %WINDIR%\dwking.exe
- %WINDIR%\dwking.exe
- <SYSTEM32>\dwking0.dll
- <DRIVERS>\cdaudio.sys
- 'localhost':1036
- DNS ASK www.ba###l90.com