Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\svchost.exe'
- '%TEMP%\svchost.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\the.pdf
- %TEMP%\svchost.exe
- %TEMP%\the.pdf
- '21#.#30.19.154':80
- 21#.#30.19.154/6704.asp
- 21#.#30.19.154/6736.asp
- 21#.#30.19.154/6619.asp
- 21#.#30.19.154/6674.asp
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'