Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Classes' = '%APPDATA%\Microsoft\jstsgwes\iivggiaw.exe'
- '%WINDIR%\explorer.exe'
- %APPDATA%\NsResize.dll
- %TEMP%\nsp3.tmp\System.dll
- %APPDATA%\Microsoft\jstsgwes\iivggiaw.exe
- %APPDATA%\Earthcloset.m
- %APPDATA%\fullscreen_toolbar.xml
- %APPDATA%\ascii.png
- %APPDATA%\queueview.png
- %APPDATA%\Microsoft\jstsgwes\iivggiaw.exe
- '20#.#6.232.182':80
- 'wp#d':80
- http://www.microsoft.com/ via 20#.#6.232.182
- http://11#.#11.111.1/wpad.dat via wp#d
- http://go.###rosoft.com/fwlink/?Li########## via 20#.#6.232.182
- DNS ASK go.###rosoft.com
- DNS ASK www.microsoft.com
- DNS ASK wp#d