Техническая информация
- %TEMP%\is-vgbev.tmp\<Имя файла>.tmp
- %TEMP%\is-8nnpb.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8nnpb.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8nnpb.tmp\itdownload.dll
- %TEMP%\is-8nnpb.tmp\rkverify.exe
- %TEMP%\is-8nnpb.tmp\rkinstaller.exe
- %TEMP%\is-8nnpb.tmp\ocsetuphlp.dll
- DNS ASK po##.##curestudies.com
- DNS ASK ap#.##encandy.com
- ClassName: '0AC6BA8F315A4246B22C05AFEF163EF7' WindowName: ''
- ClassName: '995D92B2-4ED9-43A7-9338-8CC7D1746F96' WindowName: ''
- '%TEMP%\is-vgbev.tmp\<Имя файла>.tmp' /SL5="$100222,6960525,56832,<Полный путь к файлу>"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\is-8NNPB.tmp\OCSetupHlp.dll",_OCPID905OpenCandy2@16 1784,0AC6BA8F315A4246B22C05AFEF163EF7,B7AD82C1B47A451088C465F293E32401,F034114261224FE7A6D5DEB1EE277415' (со скрытым окном)
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\is-8NNPB.tmp\OCSetupHlp.dll",_OCPID905OpenCandy2@16 1784,0AC6BA8F315A4246B22C05AFEF163EF7,B7AD82C1B47A451088C465F293E32401,F034114261224FE7A6D5DEB1EE277415