Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %TEMP%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\svchost.exe' = '%TEMP%\svchost.exe:*:Enabled:svchost.exe'
- %TEMP%\svchost.exe
- %TEMP%\system.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\a_3164_klein[1].png
- %TEMP%\svchost.exe
- 'ha#######rboerse-bestwig.com':80
- 'ma###media.com':80
- ha#######rboerse-bestwig.com/assets/images/autogen/a_3164_klein.png
- ma###media.com/
- DNS ASK ha#######rboerse-bestwig.com
- DNS ASK ma###media.com