Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IDM' = '%APPDATA%\O8L.exe'
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\winlogon.exe
- %APPDATA%\O8L.exe
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- 'po####ds.hopto.org':4050
- DNS ASK po####ds.hopto.org
- ClassName: 'Indicator' WindowName: ''