Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sidego' = '%PROGRAM_FILES%\sidego\sidego.exe'
- %TEMP%\is-9HIIF.tmp\_isetup\_RegDLL.tmp 296 300
- %TEMP%\is-4308S.tmp\is-H3LTO.tmp /SL4 $300DA "%PROGRAM_FILES%\sidego\sidego_setup_07.exe" 961998 52224 /VERYSILENT
- %PROGRAM_FILES%\sidego\sidego_setup_07.exe /VERYSILENT
- <SYSTEM32>\cmd.exe /c ""<Текущая директория>\del_nsis_bat.cmd" "
- %PROGRAM_FILES%\sidego\is-N72SP.tmp
- %PROGRAM_FILES%\sidego\is-RHPL4.tmp
- %PROGRAM_FILES%\sidego\is-6O2KE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ins[1].php
- %PROGRAM_FILES%\sidego\unins000.dat
- %PROGRAM_FILES%\sidego\is-257OC.tmp
- %PROGRAM_FILES%\sidego\is-1TCLO.tmp
- %TEMP%\is-4308S.tmp\is-H3LTO.tmp
- <Текущая директория>\del_nsis_bat.cmd
- %PROGRAM_FILES%\sidego\sidego_setup_07.exe
- %PROGRAM_FILES%\sidego\del_bat.cmd
- %TEMP%\is-9HIIF.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9HIIF.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\sidego\sidego_setup_07.exe
- %TEMP%\is-4308S.tmp\is-H3LTO.tmp
- %PROGRAM_FILES%\sidego\del_bat.cmd
- <Текущая директория>\del_nsis_bat.cmd
- %TEMP%\is-9HIIF.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-9HIIF.tmp\_isetup\_shfoldr.dll
- 'co####r.sidego.net':80
- 'localhost':1035
- co####r.sidego.net/analysis/ins.php?uq#####################################################
- DNS ASK co####r.sidego.net
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''