Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinCheck' = '<LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\bnsf7.exe'
- '<LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\bnsf7.exe' /ch=
- '<LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\nsf3.tmp' /ch= /fd=<LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787
- <LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\bnsf7.exe
- %TEMP%\nso6.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm
- %TEMP%\nsd9.tmp
- %TEMP%\nsq8.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm
- <LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\Uninstall.exe
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\WmiInspector.dll
- %TEMP%\nsg5.tmp\inetc.dll
- %TEMP%\nsg5.tmp\WmiInspector.dll
- <LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\nsf3.tmp
- <LS_APPDATA>\113D4D56-1476709690-61AC-8C86-9ACD39D93787\nsf3.tmp
- %TEMP%\nsg5.tmp\WmiInspector.dll
- %TEMP%\nsx2.tmp\WmiInspector.dll
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsq8.tmp
- %TEMP%\nso6.tmp
- %TEMP%\nsg5.tmp\inetc.dll
- %TEMP%\nsd9.tmp
- 'ib###########53175.us-east-1.elb.amazonaws.com':80
- http://ib###########53175.us-east-1.elb.amazonaws.com/
- DNS ASK ib###########53175.us-east-1.elb.amazonaws.com
- ClassName: 'Shell_TrayWnd' WindowName: ''