Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{f236e7a3-7abe-cf03-cf03-8bcf703cb2d6}] 'StubPath' = '<SYSTEM32>\ybczlsnwd\lsass.exe /t'
- C:\z.bin
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\x6dm3.swhmzq[1]
- <SYSTEM32>\ybczlsnwd\lsass.exe
- C:\z.bin
- 'x6###.swhmzq.com':80
- 'localhost':1036
- x6###.swhmzq.com/?n=###########################################
- DNS ASK x6###.swhmzq.com