Техническая информация
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'%ProgramFiles%\Client\client.exe' /startup" /f
- '<SYSTEM32>\dumprep.exe' 1672 -dm 7 7 %TEMP%\WER9c09.dir00\ctfmon.exe.hdmp 16325836412027276
- '<SYSTEM32>\dumprep.exe' 1672 -dm 7 7 %TEMP%\WER9c09.dir00\ctfmon.exe.mdmp 16325836412027256
- <SYSTEM32>\svchost.exe
- Drweb32w.exe
- l2.bin
- InphaseNXD.exe
- aion.exe
- kb_cli.exe
- lin.bin
- AVGCC32.EXE
- NAVAPW32.EXE
- spidernt.exe
- gw.exe
- Drweb32w.exe
- BBClient.exe
- zapro.exe
- httplook.exe
- ZONEALARM.EXE
- bclient.exe
- ashAvast.exe
- maplestory.exe
- ashAvSrv.exe
- loadmain.exe
- MCAGENT.EXE
- ash.exe
- dekaron.exe
- cbsmain.exe
- lotroclient.exe
- bc_loader.exe
- magent.exe
- avgcc.exe
- %TEMP%\WER9c09.dir00\ctfmon.exe.mdmp
- %TEMP%\WER9c09.dir00\ctfmon.exe.hdmp
- %TEMP%\WER9c09.dir00\appcompat.txt
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %ProgramFiles%\Client\client.exe
- '18#.#4.181.83':1604
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''