Техническая информация
- <Текущая директория>\temp.exe (загружен из сети Интернет)
- <SYSTEM32>\wscript.exe ""%TEMP%\akjsdkjsakldklasj.js""
- <SYSTEM32>\mshta.exe http://ur###nam.net/8732489273.php
- <SYSTEM32>\mshta.exe http://21#.#5.78.66/install.php?id#################################
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\u4[1].exe
- <Текущая директория>\temp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\8732489273[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\install[1].php
- %TEMP%\akjsdkjsakldklasj.js
- 'ur###nam.net':80
- 'localhost':1040
- '22#.#96.59.24':80
- 'localhost':1035
- '21#.#5.78.66':80
- 'localhost':1037
- 22#.#96.59.24/u4.exe
- ur###nam.net/8732489273.php
- 21#.#5.78.66/install.php?id#################################
- DNS ASK ur###nam.net
- ClassName: 'TForm1' WindowName: 'Safety Center'
- ClassName: 'Shell_TrayWnd' WindowName: ''