Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'syetom' = '%PROGRAM_FILES%\Nril\syetom.exe'
- '%PROGRAM_FILES%\Nril\syetom.exe'
- '%TEMP%\Updater.exe'
- '%TEMP%\Binder.exe'
- %PROGRAM_FILES%\Nril\syetom.exe
- %TEMP%\Updater.exe
- %TEMP%\Binder.exe
- 'r.###ne.qq.com':80
- 'ap#.#hessi.net':80
- 'localhost':1039
- r.###ne.qq.com/cgi-bin/user/cgi_personal_card?ui##################
- ap#.#hessi.net/ssi/fpd.php?pi#########################
- DNS ASK r.###ne.qq.com
- DNS ASK ap#.#hessi.net
- ClassName: 'Shell_TrayWnd' WindowName: ''