Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsUserManagement] 'Start' = '00000002'
- %TEMP%\svchost.bat
- <SYSTEM32>\svchost.exe -k nets
- <SYSTEM32>\wumsvc.dll
- %TEMP%\ІвКФ.xls
- %TEMP%\svchost.bat
- '11#.#0.201.169':81
- '11#.#0.201.169':8080
- '11#.#0.201.169':80
- 11#.#0.201.169/index.asp?se####################################################