Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winlogin' = '<SYSTEM32>\winlogin.exe'
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\net.exe stop sharedaccess
- <SYSTEM32>\szafa1.txt
- <SYSTEM32>\winlogin.exe
- 'ho####ssftp.za.pl':21
- DNS ASK ho####ssftp.za.pl
- ClassName: 'ConsoleWindowClass' WindowName: ''