Техническая информация
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Win32' = '<SYSTEM32>\Windll\Win32.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Win32' = '<SYSTEM32>\Windll\Win32.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5M38D3E2-18CC-QJ05-0FKQ-V1R21872B5G1}] 'StubPath' = '<SYSTEM32>\Windll\Win32.exe Restart'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5M38D3E2-18CC-QJ05-0FKQ-V1R21872B5G1}] 'StubPath' = '<SYSTEM32>\Windll\Win32.exe'
- %WINDIR%\syswow64\explorer.exe
- win32.exe
- %WINDIR%\syswow64\windll\win32.exe
- %TEMP%\user2.txt
- %TEMP%\user7
- %TEMP%\user8
- %WINDIR%\syswow64\windll\win32.exe
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
- %TEMP%\user8
- %TEMP%\user7
- DNS ASK mi####.zapto.org
- '%WINDIR%\syswow64\windll\win32.exe'
- '%WINDIR%\syswow64\explorer.exe'