Техническая информация
- '<SYSTEM32>\dxdiag.exe' /t %APPDATA%\dx.txt
- '<SYSTEM32>\cmd.exe' /c attrib -h -s -r %appdata%\sclientappfol\client32.ini
- '<SYSTEM32>\attrib.exe' -h -s -r %APPDATA%\sclientappfol\client32.ini
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\gbsafe.bat" "
- '%APPDATA%\utiliz.exe' as.au3
- '<SYSTEM32>\cmd.exe' /c dxdiag /t %APPDATA%\dx.txt
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\utiliz.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\dx.txt
- %APPDATA%\res.txt
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab1.tmp
- %APPDATA%\mine.cmd
- %APPDATA%\Array.au3
- %APPDATA%\gbsafe.bat
- %APPDATA%\deltr.cmd
- %APPDATA%\FileConstants.au3
- %APPDATA%\mine.ps1
- %APPDATA%\as.au3
- %APPDATA%\File.au3
- %APPDATA%\dx.txt
- %TEMP%\Cab1.tmp
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''