Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{B03A4BE6-5E5A-483E-B9B3-C484D4B20B72}' = 'hook dll rising'
- <DRIVERS>\cdaudio.sys файлом <DRIVERS>\SET2.tmp
- '%WINDIR%\AhnRpta.exe'
- <SYSTEM32>\dllcache\cdaudio.sys.new
- %TEMP%\ah1.txt
- %TEMP%\ah2.txt
- <DRIVERS>\SET2.tmp
- <SYSTEM32>\ahnoo0.dll
- %WINDIR%\AhnRpta.exe
- <DRIVERS>\SET1.tmp
- %TEMP%\ah1.txt
- %TEMP%\ah2.txt
- <DRIVERS>\cdaudio.sys
- <DRIVERS>\SET1.tmp
- 'localhost':1041
- 'www.16##ui.com':80
- 'localhost':1038
- http://www.16##ui.com/1hg/ah2.txt
- http://www.16##ui.com/1hg/ah1.txt
- DNS ASK www.16##ui.com