Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ca1c404e46c83a3a68a6dc7fd4c205b9' = '"%ALLUSERSPROFILE%\Application Data\svchost.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ca1c404e46c83a3a68a6dc7fd4c205b9' = '"%ALLUSERSPROFILE%\Application Data\svchost.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\ca1c404e46c83a3a68a6dc7fd4c205b9.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Application Data\svchost.exe' = '%ALLUSERSPROFILE%\A...
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ALLUSERSPROFILE%\Application Data\svchost.exe" "svchost.exe" ENABLE
- %TEMP%\is-R2FF5.tmp\pdf-pwd-remover.tmp
- %TEMP%\is-CTSJO.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\Application Data\svchost.exe
- %APPDATA%\pdf-pwd-remover.exe
- 'mo###.0pe.kr':1111
- DNS ASK mo###.0pe.kr
- '%TEMP%\is-R2FF5.tmp\pdf-pwd-remover.tmp' /SL5="$300DE,1305861,56832,%APPDATA%\pdf-pwd-remover.exe"
- '%APPDATA%\pdf-pwd-remover.exe'
- '%ALLUSERSPROFILE%\Application Data\svchost.exe'