Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'agcnmssrsr' = 'C:\Users\Public\agcnmssrsr.vbs'
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
- %HOMEPATH%\appvsentinel\rtlupd64.bat
- %TEMP%\fx12cxxr.0.cs
- %TEMP%\fx12cxxr.cmdline
- %TEMP%\fx12cxxr.out
- %TEMP%\csc1.tmp
- %TEMP%\res2.tmp
- %TEMP%\fx12cxxr.dll
- %TEMP%\res2.tmp
- %TEMP%\csc1.tmp
- %TEMP%\fx12cxxr.0.cs
- %TEMP%\fx12cxxr.cmdline
- %TEMP%\fx12cxxr.dll
- %TEMP%\fx12cxxr.out
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- DNS ASK ha###.ddns.net
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fx12cxxr.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fx12cxxr.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"