Техническая информация
- '%APPDATA%\Roaming\RtWin.exe'
- '%APPDATA%\Roaming\RtWin.exe' (загружен из сети Интернет)
- %APPDATA%\Roaming\RtWin.exe
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\hey[1].exe
- 'www.ab#####ducoes.com.br':80
- www.ab#####ducoes.com.br/site/libraries/hey.exe
- DNS ASK www.ab#####ducoes.com.br
- ClassName: 'Shell_TrayWnd' WindowName: ''