Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'airplugin.v2.55.6' = 'rundll32 "%ALLUSERSPROFILE%\Application Data\Adobe\airplugin.v2.55.6.cpl" ,start1 /exc'
- '%TEMP%\tmp4328\ins6297.exe' mpro44.cpl "1(165).jpg"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\tmp4328\1(165).jpg
- %TEMP%\tmp4328\1(165).jpg
- %ALLUSERSPROFILE%\Application Data\Adobe\readme.txt
- %ALLUSERSPROFILE%\Application Data\Adobe\airplugin.v2.55.6.cpl
- %TEMP%\tmp4328\readme.txt
- %TEMP%\tmp4328\ins6297.exe
- %TEMP%\tmp4328\mpro44.cpl
- ClassName: 'TRONVCPLB' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'TFRegWOp' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''