Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TGrOoCHOZzaj' = 'control.exe "%PROGRAM_FILES%\lposxi\TGrOoCHOZzaj.cpl",0,1'
- %TEMP%\is-1A2N5.tmp\convert-windows-live-mail-to-pst-2.0.tmp /SL5="$300DA,1607626,54272,%TEMP%\convert-windows-live-mail-to-pst-2.0.exe"
- %TEMP%\convert-windows-live-mail-to-pst-2.0.exe
- <SYSTEM32>\rundll32.exe Shell32.dll,Control_RunDLL "%PROGRAM_FILES%\lposxi\TGrOoCHOZzaj.cpl",0,1
- <SYSTEM32>\control.exe "%PROGRAM_FILES%\lposxi\TGrOoCHOZzaj.cpl",0,1
- <SYSTEM32>\rundll32.exe Shell32.dll,Control_RunDLL "%TEMP%\EcShB9vgf.dll",0,-4
- %TEMP%\convert-windows-live-mail-to-pst-2.0.log
- %TEMP%\is-ANVQ0.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\lposxi\TGrOoCHOZzaj.cpl
- %TEMP%\EcShB9vgf.dll
- %TEMP%\nsu2.tmp\NSISdl.dll
- %TEMP%\convert-windows-live-mail-to-pst-2.0.exe
- %TEMP%\is-ANVQ0.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-1A2N5.tmp\convert-windows-live-mail-to-pst-2.0.tmp
- %TEMP%\nsu2.tmp\NSISdl.dll
- %TEMP%\EcShB9vgf.dll
- 'fr####ersion.biz':80
- fr####ersion.biz/version.php?ve###############################################
- DNS ASK fr####ersion.biz
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''