Техническая информация
- %TEMP%\nsm4.tmp\ns5.tmp c:\4843.bat
- %TEMP%\PPTV(pplive)_forqiqi_9155.exe
- %TEMP%\kugou_2555.exe
- %HOMEPATH%\Templates\mn3248.exe
- %HOMEPATH%\Templates\Downloader_2555.exe
- %HOMEPATH%\Templates\Loader_forqiqi_9155.exe
- %TEMP%\kugou_2555.exe (загружен из сети Интернет)
- %TEMP%\PPTV(pplive)_forqiqi_9155.exe (загружен из сети Интернет)
- <SYSTEM32>\wbem\wmic.exe userAccount where "Name='%USERNAME%'" get SID /value
- <SYSTEM32>\cmd.exe /c c:\4843.bat
- [<HKCU>\Software\FlashFXP]
- %TEMP%\tmp6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\PPTV(pplive)_forqiqi_9155[1].exe
- %TEMP%\nsm4.tmp\nsExec.dll
- %TEMP%\nsm4.tmp\ns5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\kugou_2555[1].exe
- %TEMP%\kugou_2555.exe
- %TEMP%\PPTV(pplive)_forqiqi_9155.exe
- %TEMP%\tmp7.tmp
- %HOMEPATH%\Templates\re4832.txt
- %HOMEPATH%\Templates\a.bat
- %TEMP%\nsy2.tmp\System.dll
- %HOMEPATH%\Templates\read.txt
- %TEMP%\nsm4.tmp\System.dll
- C:\4843.bat
- %HOMEPATH%\Templates\Downloader_2555.exe
- %HOMEPATH%\Templates\Loader_forqiqi_9155.exe
- %TEMP%\tmp6.tmp
- %TEMP%\nsy2.tmp\System.dll
- 'xi####.kugou.com':80
- 'do####ad.pplive.com':80
- 'localhost':1036
- xi####.kugou.com/Corp/kugou_2555.exe
- do####ad.pplive.com/PPTV(pplive)_forqiqi_9155.exe
- DNS ASK xi####.kugou.com
- DNS ASK do####ad.pplive.com