Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%TEMP%\Winlogin.exe'
- %TEMP%\XBSlink_setup_0.9.2.0.exe
- %TEMP%\nsu3.tmp\modern-wizard.bmp
- %TEMP%\nsu3.tmp\nsDialogs.dll
- %TEMP%\nsu3.tmp\System.dll
- %TEMP%\Winlogin.exe
- %TEMP%\XBSlink_setup_0.9.2.0.exe
- %TEMP%\nsj2.tmp
- %TEMP%\XBSlink_setup_0.9.2.0.exe
- 'wh###smyip.com':80
- wh###smyip.com/automation/n09230945.asp
- DNS ASK wh###smyip.com
- ClassName: 'Shell_TrayWnd' WindowName: ''