Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsFireWall' = '%TEMP%\/WindowsFireWall.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%TEMP%\Safe.exe'
- %TEMP%\Safe.exe
- %TEMP%\WindowsFireWall.exe
- %TEMP%\Safe.exe
- %APPDATA%\WinHost.exe
- ClassName: 'Indicator' WindowName: ''