Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system' = '<SYSTEM32>\server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{D0E489CE-B1FC-EE8C-F7F8-EC08FCAC9278}] 'StubPath' = '<SYSTEM32>\server.exe'
- '<SYSTEM32>\server.exe'
- <SYSTEM32>\server.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut1.tmp
- 'ac######ahmoud333.no-ip.biz':3460
- DNS ASK ac######ahmoud333.no-ip.biz