Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %TEMP%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\svchost.exe' = '%TEMP%\svchost.exe:*:Enabled:svchost.exe'
- %TEMP%\svchost.exe
- %TEMP%\system.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ZOF109_Buero2_H1834_H2094_H2824_H3027_M1[1].JPG
- %TEMP%\svchost.exe
- 'pu####bestwig.de':80
- 'ma###media.com':80
- pu####bestwig.de/assets/images/ZOF109_Buero2_H1834_H2094_H2824_H3027_M1.JPG
- ma###media.com/
- DNS ASK pu####bestwig.de
- DNS ASK ma###media.com