Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = 'C:\'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSE' = '%TEMP%\taskmrg.exe'
- %TEMP%\MZpyI.exe
- %TEMP%\ChSDIq.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe /noconfig /fullpaths @"%TEMP%\fyf_hyid.cmdline"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe /noconfig /fullpaths @"%TEMP%\zbar_6mn.cmdline"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- %TEMP%\MZpyI.exe
- %TEMP%\fyf_hyid.out
- %TEMP%\fyf_hyid.cmdline
- %TEMP%\taskmrg.exe
- %TEMP%\BmaZIY.exe
- %TEMP%\RES4.tmp
- %TEMP%\CSC3.tmp
- %TEMP%\fyf_hyid.0.cs
- %TEMP%\zbar_6mn.out
- %TEMP%\zbar_6mn.cmdline
- %TEMP%\zbar_6mn.0.cs
- %TEMP%\CSC1.tmp
- %TEMP%\resource.resources
- %TEMP%\ChSDIq.exe
- %TEMP%\RES2.tmp
- %TEMP%\CSC3.tmp
- %TEMP%\RES4.tmp
- %TEMP%\fyf_hyid.0.cs
- %TEMP%\fyf_hyid.cmdline
- %TEMP%\fyf_hyid.out
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\zbar_6mn.cmdline
- %TEMP%\zbar_6mn.out
- %TEMP%\zbar_6mn.0.cs
- DNS ASK www.gm#.##hostingx.com
- ClassName: 'Indicator' WindowName: ''