Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{880B1B27-7B77-E423-0347-8DEDEC21E14A}] 'StubPath' = '<SYSTEM32>\userin.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\userin.exe
- 'am####.kimoo.com.tw':8080
- DNS ASK am####.kimoo.com.tw