Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'load' = '%TEMP%\svchost.exe'
- '%TEMP%\svchost.exe'
- %TEMP%\AcroRd32_5.ico
- %TEMP%\svchost.exe
- 're####.crabdance.com':80
- re####.crabdance.com/report/news.html
- DNS ASK re####.crabdance.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''