Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TjKzXiyfZxFTk' = 'control.exe "%PROGRAM_FILES%\lw74dYZC1K\TjKzXiyfZxFTk.cpl",0,1'
- %TEMP%\machete-3.6-build-44.exe
- <SYSTEM32>\control.exe "%PROGRAM_FILES%\lw74dYZC1K\TjKzXiyfZxFTk.cpl",0,1
- <SYSTEM32>\rundll32.exe Shell32.dll,Control_RunDLL "%PROGRAM_FILES%\lw74dYZC1K\TjKzXiyfZxFTk.cpl",0,1
- <SYSTEM32>\rundll32.exe Shell32.dll,Control_RunDLL "%TEMP%\3TJV8GPenS6Gf.dll",0,-9
- <SYSTEM32>\msiexec.exe /i "%TEMP%\RarSFX0\MacheteInst.msi"
- <SYSTEM32>\msiexec.exe /V
- %TEMP%\24116.msi
- %TEMP%\3TJV8GPenS6Gf.dll
- %PROGRAM_FILES%\lw74dYZC1K\TjKzXiyfZxFTk.cpl
- %TEMP%\machete-3.6-build-44.log
- %TEMP%\machete-3.6-build-44.exe
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\RarSFX0\MacheteInst.msi
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\3TJV8GPenS6Gf.dll
- 'fr####ersion.biz':80
- fr####ersion.biz/version.php?ve###############################
- DNS ASK fr####ersion.biz
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''