Техническая информация
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\Darwin.dll
- '<SYSTEM32>\wscript.exe' /B "%TEMP%\NLo.vbe"
- %HOMEPATH%\UpLow5604
- %WINDIR%\Darwin.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Th[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\KTLON[1]
- %TEMP%\NLo.vbe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RSLOR[1]
- %TEMP%\Mron.dnL
- %TEMP%\NLo.vbe
- %TEMP%\Mron.dnL
- %HOMEPATH%\UpLow5604 в %HOMEPATH%\UpLow5604.exe
- 'www.fr#####illacalcio.it':80
- 'www.ne###dia.com.pl':80
- 'localhost':1035
- www.fr#####illacalcio.it/images/banners/Th.php?MC##############################################
- www.ne###dia.com.pl/htmls/torby/KTLON
- www.ne###dia.com.pl/htmls/torby/RSLOR
- DNS ASK www.fr#####illacalcio.it
- DNS ASK www.ne###dia.com.pl
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'