Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoAudio.exe' = '"%TEMP%\avp.exe"'
- <SYSTEM32>\cscript.exe ""%TEMP%\temp.vbs""
- %TEMP%\temp.vbs
- <SYSTEM32>\wmsec.dat
- <Текущая директория>\Taniltsuulga-.doc
- %TEMP%\avp.exe
- <SYSTEM32>\wmsec.dat
- %TEMP%\temp.vbs
- 'mo###l.mine.nu':80
- 'mo###l1.mine.nu':53
- DNS ASK mo###l.mine.nu
- DNS ASK mo###l1.mine.nu
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''