Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '365web' = '%PROGRAM_FILES%\365web\web365.exe'
- %PROGRAM_FILES%\365web\365web_setup_01.exe /VERYSILENT
- <SYSTEM32>\cmd.exe /c ""<Текущая директория>\del_nsis_bat.cmd" "
- %PROGRAM_FILES%\365web\is-K2JPL.tmp
- %PROGRAM_FILES%\365web\is-43UN9.tmp
- %PROGRAM_FILES%\365web\is-0CN62.tmp
- %PROGRAM_FILES%\365web\is-M4I2N.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ins[1].php
- %PROGRAM_FILES%\365web\unins000.dat
- %PROGRAM_FILES%\365web\is-1UQ2B.tmp
- %PROGRAM_FILES%\365web\is-9J2OS.tmp
- %TEMP%\is-ISSDR.tmp\is-AOTEB.tmp
- <Текущая директория>\del_nsis_bat.cmd
- %PROGRAM_FILES%\365web\365web_setup_01.exe
- %TEMP%\is-BOQK8.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\365web\is-MLB7G.tmp
- %PROGRAM_FILES%\365web\del_bat.cmd
- %TEMP%\is-BOQK8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-BOQK8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ISSDR.tmp\is-AOTEB.tmp
- %PROGRAM_FILES%\365web\del_bat.cmd
- <Текущая директория>\del_nsis_bat.cmd
- %PROGRAM_FILES%\365web\365web_setup_01.exe
- %TEMP%\is-BOQK8.tmp\_isetup\_RegDLL.tmp
- 'co####r.365web.kr':80
- 'localhost':1035
- co####r.365web.kr/analysis/ins.php?uq#####################################################
- DNS ASK co####r.365web.kr
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''