Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SynTPEnh' = '%HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Calculator' = '%HOMEPATH%\Local Settings\Microsoft\Calculator.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'app' = '%HOMEPATH%\Local Settings\app.exe'
- '%TEMP%\services.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:999'
- %TEMP%\290875.BXA
- %TEMP%\291062.BXA
- %TEMP%\288968.BXA
- %TEMP%\288005.dat
- %TEMP%\288000.dat
- %HOMEPATH%\Local Settings\Microsoft\Calculator.exe
- %HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe
- %HOMEPATH%\Local Settings\app.exe
- %TEMP%\291140.BXA
- %TEMP%\292265.BXA
- %TEMP%\287156.dat
- %TEMP%\286598.dat
- %TEMP%\286593.dat
- %HOMEPATH%\Local Settings\IconCache2.db
- %TEMP%\services.exe
- %TEMP%\286406.dat
- %TEMP%\286921.dat
- %TEMP%\287161.dat
- %TEMP%\286926.dat
- %TEMP%\286770.dat
- %TEMP%\286765.dat
- %HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe
- %HOMEPATH%\Local Settings\Microsoft\Calculator.exe
- %HOMEPATH%\Local Settings\app.exe
- %TEMP%\288000.dat
- %TEMP%\288968.BXA
- %TEMP%\287156.dat
- %TEMP%\288005.dat
- %TEMP%\291140.BXA
- %TEMP%\292265.BXA
- %TEMP%\290875.BXA
- %TEMP%\291062.BXA
- %TEMP%\286593.dat
- %TEMP%\286770.dat
- %TEMP%\286406.dat
- %TEMP%\286598.dat
- %TEMP%\286921.dat
- %TEMP%\287161.dat
- %TEMP%\286765.dat
- %TEMP%\286926.dat
- 'ga#####.twilightparadox.com':5013
- DNS ASK ga#####.twilightparadox.com
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'