Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSE' = '%TEMP%\taskmgr.exe'
- %TEMP%\keylogger.exe
- %TEMP%\B9o50j.exe
- %TEMP%\KDrMtv.exe
- %TEMP%\pinlogger.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe /noconfig /fullpaths @"%TEMP%\iig2s9ng.cmdline"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe /noconfig /fullpaths @"%TEMP%\b9kruipa.cmdline"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- %TEMP%\pinlogger.exe
- %TEMP%\taskmgr.exe
- %TEMP%\iig2s9ng.out
- %TEMP%\[INJECT-INTO].exe
- %TEMP%\RES4.tmp
- %TEMP%\B9o50j.exe
- %TEMP%\keylogger.exe
- %TEMP%\CSC3.tmp
- %TEMP%\iig2s9ng.cmdline
- %TEMP%\b9kruipa.out
- %TEMP%\CSC1.tmp
- %TEMP%\b9kruipa.0.cs
- %TEMP%\b9kruipa.cmdline
- %TEMP%\resource.resources
- %TEMP%\iig2s9ng.0.cs
- %TEMP%\RES2.tmp
- %TEMP%\KDrMtv.exe
- %TEMP%\iig2s9ng.cmdline
- %TEMP%\CSC3.tmp
- %TEMP%\iig2s9ng.0.cs
- %TEMP%\resource.resources
- %TEMP%\iig2s9ng.out
- %TEMP%\RES4.tmp
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\b9kruipa.out
- %TEMP%\b9kruipa.0.cs
- %TEMP%\b9kruipa.cmdline
- 'sm##.gmail.com':587
- DNS ASK sm##.gmail.com
- '<IP-адрес в локальной сети>':1038
- '<IP-адрес в локальной сети>':1037
- ClassName: 'Indicator' WindowName: ''