Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft WinHost' = '%TEMP%\Winhost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft WinHost' = '%TEMP%\Winhost.exe'
- %TEMP%\WinHost\Removable_E_out.txt
- %TEMP%\WinHost\Removable_E.txt.gz
- %TEMP%\WinHost\Fixed_C.txt.gz
- %TEMP%\Winhost.exe
- %TEMP%\WinHost\Fixed_C_out.txt
- %TEMP%\WinHost\Removable_E.txt.gz
- %TEMP%\WinHost\Fixed_C.txt.gz
- %TEMP%\WinHost\Removable_E_out.txt
- %TEMP%\WinHost\Fixed_C_out.txt
- ClassName: 'Indicator' WindowName: ''