Техническая информация
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '%APPDATA%\app\winlogon.exe..exe'
- %APPDATA%\app\winlogon.exe..exe
- %APPDATA%\app\set.bin
- http://www.op#####.freehosting.com/Webpanel/ip.php
- http://www.op#####.freehosting.com/Webpanel/connect.php
- DNS ASK op#####.freehosting.com
- DNS ASK fr###osting.com
- '%APPDATA%\app\winlogon.exe..exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%APPDATA%\app\winlogon.exe..exe"