Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OfficeServices' = '%APPDATA%\OfficeService.exe'
- %APPDATA%\OfficeService.exe
- %TEMP%\screen_07-12-2018 08-20.jpg
- %TEMP%\screen_07-12-2018 08-21.jpg
- 'sm##.gmail.com':587
- DNS ASK sm##.gmail.com
- '%APPDATA%\OfficeService.exe'