Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SynTPEnh' = '<LS_APPDATA>\SynTPEnh.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '' = '<LS_APPDATA>\SynTPEnh.exe'
- '%TEMP%\SynTPEnh.exe'
- %TEMP%\SynTPEnh.exe
- <LS_APPDATA>\SynTPEnh.exe
- 'un#####dcraft.no-ip.biz':447
- DNS ASK dn#.##ftncsi.com
- DNS ASK un#####dcraft.no-ip.biz