Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'crypton' = '%APPDATA%\Crypton.exe'
- '<SYSTEM32>\cmd.exe' /c "start %HOMEPATH%\Desktop\Tatiana_Photo2016"
- '%APPDATA%\crypton.exe' "<Имя файла>.exe" 11 ru
- %HOMEPATH%\Desktop\Tatiana_Photo2016\Print_02.jpg
- %HOMEPATH%\Desktop\Tatiana_Photo2016\Print_03.jpg
- %HOMEPATH%\Desktop\Tatiana_Photo2016\Print_04.jpg
- %HOMEPATH%\Desktop\Tatiana_Photo2016\Print_01.jpg
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\crypton.exe
- 'in.###clever.net':80
- 'sr##.#niclever.net':80
- 'wp#d':80
- 'www.download.windowsupdate.com':80
- http://in.###clever.net/
- http://sr##.#niclever.net/
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- DNS ASK in.###clever.net
- DNS ASK sr##.#niclever.net
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
- ClassName: 'Shell_TrayWnd' WindowName: ''