Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSUPD32' = '%APPDATA%\wuaclt.exe'
- %APPDATA%\wuaclt.exe
- %APPDATA%\wuaclt.exe
- 'an######scan.strangled.net':80
- 'an######scan.strangled.net':443
- 'ip#####.ignorelist.com':80
- 'ip#####.ignorelist.com':443
- http://an######scan.strangled.net/0000/a169375.asp
- http://ip#####.ignorelist.com/0000/a151546.asp
- DNS ASK an######scan.strangled.net
- DNS ASK ip#####.ignorelist.com
- ClassName: 'Indicator' WindowName: ''