Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{0F80FABC-8CB5-235F-0F1E-C25D8E66F234}] 'StubPath' = '<SYSTEM32>\ACTIVES.EXE'
- [<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = ''
- <SYSTEM32>\ACTIVES.EXE
- %APPDATA%\ppsavl.exe
- 'de####day.gicp.net':2520
- DNS ASK de####day.gicp.net