Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{FF871070-ADA4-275F-D7CB-11FA17132F04}] 'StubPath' = '<SYSTEM32>\cresse.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\cresse.exe
- %APPDATA%\webupdate.dat
- %APPDATA%\webupdate.dat
- 'ad###.fcph.org':80
- DNS ASK ad###.fcph.org