Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CorrM' = '%TEMP%\CorrM1.exe'
- '%TEMP%\CorrM1.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\svchost.exe
- netxray.exe
- contactNG.exe
- clntw32.exe
- NAVAPW32.EXE
- kb_cli.ex
- opera.exe
- outpost.exe
- oncbcli.exe
- rclient.exe
- 360tray.exe
- nod32.exe
- %TEMP%\CorrM_Reg_Proc.dll
- %TEMP%\CorrM1.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- %TEMP%\CorrM1.exe
- '20#.#6.232.182':80
- 'wp#d':80
- 20#.#6.232.182/pki/crl/products/CSPCA.crl
- wp#d/wpad.dat
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''