Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Microsoft Services' = '<SYSTEM32>\bsc32.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Services' = '<SYSTEM32>\bsc32.exe'
- <SYSTEM32>\bsc32.exe
- <SYSTEM32>\cmd.exe /c mfksxh.bat
- <Текущая директория>\mfksxh.bat
- <SYSTEM32>\bsc32.exe
- <SYSTEM32>\bsc32.exe
- 'www.uk###h.co.uk':80
- www.uk###h.co.uk/rps.php?ad#######
- DNS ASK www.uk###h.co.uk