Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\citrix] 'Start' = '00000002'
- '%TEMP%\ssonsvr.exe'
- '<SYSTEM32>\msiexec.exe'
- <SYSTEM32>\msiexec.exe
- %ALLUSERSPROFILE%\Application Data\citrix\config.ini
- %TEMP%\ssonsvr.exe
- %TEMP%\pnipcn.dll
- %TEMP%\pnipcn.dll.url в %ALLUSERSPROFILE%\Application Data\citrix\pnipcn.dll.url
- %TEMP%\pnipcn.dll в %ALLUSERSPROFILE%\Application Data\citrix\pnipcn.dll
- %TEMP%\ssonsvr.exe в %ALLUSERSPROFILE%\Application Data\citrix\svchost.exe
- 'up####.pchomeserver.com':80
- DNS ASK up####.pchomeserver.com