Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Network Name Service] 'Start' = '00000002'
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Network Name Service\wnns.exe
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Network Name Service\wnns.exe /Service
- <SYSTEM32>\stamp.dat
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Network Name Service\network.dat
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Network Name Service\wnns.exe
- 'ne###arings.com':80
- 'th####sharing.com':80
- 'ne####ringsite.com':80
- ne###arings.com/advfeed.php
- th####sharing.com/advfeed.php
- ne####ringsite.com/advfeed.php
- DNS ASK ne###arings.com
- DNS ASK th####sharing.com
- DNS ASK ne####ringsite.com