Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinCheck' = '<LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\bnsy7.exe'
- '<LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\bnsy7.exe' /ch=
- '<LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\nsw3.tmp' /ch= /fd=<LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B
- <LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\bnsy7.exe
- %TEMP%\nsn6.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm
- %TEMP%\nsl9.tmp
- %TEMP%\nso8.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm
- <LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\Uninstall.exe
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\WmiInspector.dll
- %TEMP%\nsh5.tmp\inetc.dll
- %TEMP%\nsh5.tmp\WmiInspector.dll
- <LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\nsw3.tmp
- <LS_APPDATA>\55704D56-1477926366-1FCD-859E-69E0092ECF5B\nsw3.tmp
- %TEMP%\nsh5.tmp\WmiInspector.dll
- %TEMP%\nse2.tmp\WmiInspector.dll
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nso8.tmp
- %TEMP%\nsn6.tmp
- %TEMP%\nsh5.tmp\inetc.dll
- %TEMP%\nsl9.tmp
- 'ib###########53175.us-east-1.elb.amazonaws.com':80
- http://ib###########53175.us-east-1.elb.amazonaws.com/
- DNS ASK ib###########53175.us-east-1.elb.amazonaws.com
- ClassName: 'Shell_TrayWnd' WindowName: ''