Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Adobe Reader' = '%APPDATA%\plugin.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adobe Reader' = '%APPDATA%\plugin.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%APPDATA%\plugin.exeexplorer.exe'
- <SYSTEM32>\svchost.exe
- %APPDATA%\plugin.exe
- %TEMP%\user2.txt
- %APPDATA%\userlog.dat
- %TEMP%\user7
- %TEMP%\user8
- %APPDATA%\userlog.dat
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- DNS ASK an####ill.webhop.me
- '<SYSTEM32>\svchost.exe'