Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SysUtil' = 'c:\systems.exe'
- %WINDIR%\Temp\muzbaza.exe
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /t REG_SZ /v SysUtil /d "c:\systems.exe" /f
- %WINDIR%\Temp\muzbaza.exe
- C:\systems.exe
- C:\systems.exe
- 'mu###aza.net':80
- 'wp#d':80
- mu###aza.net/version/
- wp#d/wpad.dat
- DNS ASK mu###aza.net
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''