Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'dplaysvr' = '%LOCALAPPDATA%\dplaysvr.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'dplaysvr' = '%LOCALAPPDATA%\dplaysvr.exe'
- %TEMP%\5c23.tmp
- %TEMP%\5c34.tmp
- %TEMP%\5c45.tmp
- %LOCALAPPDATA%\dplaysvr.exe
- %LOCALAPPDATA%\dplayx.dll
- %TEMP%\5c23.tmp
- %TEMP%\5c34.tmp
- %TEMP%\5c45.tmp
- '19#.#66.218.217':80
- '%LOCALAPPDATA%\dplaysvr.exe' <Полный путь к файлу>