Техническая информация
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %APPDATA%\RamExpert\libexe.exe
- %APPDATA%\RamExpert\libcrypto-1_1.dll
- %APPDATA%\RamExpert\libssl-1_1.dll
- %APPDATA%\RamExpert\RAMExpert.exe
- %APPDATA%\RamExpert\ram.reg
- %APPDATA%\RamExpert\ram2.reg
- %APPDATA%\RamExpert\ram3.reg
- %APPDATA%\RamExpert\ramm.reg
- %APPDATA%\RamExpert\rama.reg
- %APPDATA%\RamExpert\Uninstall.exe
- %HOMEPATH%\Desktop\RamExpert.lnk
- %HOMEPATH%\Start Menu\RamExpert.lnk
- %APPDATA%\RamExpert\Uninstall.ini
- %APPDATA%\RamExpert\libu.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- 'localhost':1038
- '2n#.co':443
- DNS ASK 2n#.co
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- '%APPDATA%\RamExpert\libexe.exe' -pGDJXxQD99wqaa8889 -s1
- '%APPDATA%\RamExpert\RAMExpert.exe'
- '%APPDATA%\RamExpert\libu.exe'
- '%WINDIR%\regedit.exe' /s %APPDATA%\RamExpert\rama.reg
- '%WINDIR%\regedit.exe' /s %APPDATA%\RamExpert\ram.reg
- '%WINDIR%\regedit.exe' /s %APPDATA%\RamExpert\ram2.reg
- '%WINDIR%\regedit.exe' /s %APPDATA%\RamExpert\ram3.reg
- '%WINDIR%\regedit.exe' /s %APPDATA%\RamExpert\ramm.reg
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome