Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\Media\Installed\lsass.exe'
- %WINDIR%\Media\Installed\lsass.exe
- %WINDIR%\Media\Installed\MSWINSCK.OCX
- %WINDIR%\Media\Installed\lsass.exe
- %WINDIR%\Media\Installed\MSWINSCK.OCX
- %WINDIR%\Media\Installed\lsass.exe
- %TEMP%\~DF91D3.tmp
- 'pu#####zzzz.no-ip.biz':13334
- DNS ASK pu#####zzzz.no-ip.biz