Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Dorm' = '%PROGRAM_FILES%\House\Dorm\crypts.exe'
- [<HKLM>\SYSTEM\ControlSet001\services\Dhcp] 'Start' = '00000002'
- '%PROGRAM_FILES%\House\Dorm\crypts.exe'
- '<SYSTEM32>\WScript.exe' "%PROGRAM_FILES%\House\Dorm\bi2puk.vbs"
- '<SYSTEM32>\WScript.exe' "%PROGRAM_FILES%\House\Dorm\slonopotam.vbs"
- %PROGRAM_FILES%\House\Dorm\Uninstall.exe
- %PROGRAM_FILES%\House\Dorm\bi2puk.vbs
- %PROGRAM_FILES%\House\Dorm\crypts.exe
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\348[1]
- \Device\Mup\BVNSEUHJ*\MAILSLOT\NET\NETLOGON
- %PROGRAM_FILES%\House\Dorm\Uninstall.ini
- %PROGRAM_FILES%\House\Dorm\slonopotam.vbs
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %PROGRAM_FILES%\House\Dorm\3.txt
- %PROGRAM_FILES%\House\Dorm\4.txt
- %PROGRAM_FILES%\House\Dorm\instagramm.bat
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- '10#.#07.142.110':80
- 10#.#07.142.110/apologi/trotski/348/?mw########
- DNS ASK se#####13.gglerr.com
- DNS ASK se#####5.sendrepp.com
- DNS ASK se#####6.updmaker.com
- DNS ASK se#####10.muzboxxx.cn
- DNS ASK se#####30.muzboxxx.cn
- DNS ASK dn#.##ftncsi.com
- DNS ASK se#####14.sendrepp.com
- ClassName: 'Shell_TrayWnd' WindowName: ''