Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Utilitaire de chiffrement Windows®' = '%APPDATA%\system\Utilitaire de chiffrement Windows®.exe'
- %APPDATA%\system\Utilitaire de chiffrement Windows®.exe
- 'li##o.eu.cr':80
- 'wp#d':80
- li##o.eu.cr/Safe/config/Etat.txt
- wp#d/wpad.dat
- DNS ASK li##o.eu.cr
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''