Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'windll32' = ''
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{15YM3E37-R728-724O-2SJ3-IHD2263FS7OK}] 'StubPath' = '<SYSTEM32>\windll32\windll32.exe Restart'
- %WINDIR%\explorer.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\windll32\windll32.exe
- <SYSTEM32>\windll32\plugin.dat
- <SYSTEM32>\windll32\logs.dat
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\88603cb2913a7df3fbd16b5f958e6447_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\ea0b17da-5d57-4c90-8fb7-887560053f3b
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- <SYSTEM32>\windll32\plugin.dat
- <SYSTEM32>\windll32\windll32.exe
- <SYSTEM32>\windll32\logs.dat
- 's3#.#o-ip.biz':81
- DNS ASK s3#.#o-ip.biz
- ClassName: 'Shell_TrayWnd' WindowName: ''