Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '38a365d793b3ef92f79564a9e72ad028' = '"%HOMEPATH%\system.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '38a365d793b3ef92f79564a9e72ad028' = '"%HOMEPATH%\system.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\windows.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\system.exe' = '%HOMEPATH%\system.exe:*:Enabled:system.exe'
- '%HOMEPATH%\system.exe'
- '%TEMP%\windows.exe'
- '%TEMP%\ZD Soft Screen Recorder v5.4-setup.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\system.exe" "system.exe" ENABLE
- %TEMP%\nsl4.tmp\NSISdl.dll
- C:\setup.dll
- %TEMP%\ii_start.txt
- %HOMEPATH%\system.exe
- %TEMP%\windows.exe
- %TEMP%\aut1.tmp
- %TEMP%\ZD Soft Screen Recorder v5.4-setup.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- 'mo####.no-ip.biz':1177
- '46.##.100.248':80
- 46.##.100.248/launch_v3.php?p=#################################
- DNS ASK mo####.no-ip.biz
- DNS ASK pe###3i.info
- DNS ASK pe##ik.net
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'