Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%TEMP%\internet explorer\internet explorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%APPDATA%\Microsoft\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%TEMP%\internet explorer\internet explorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%APPDATA%\Internet Explorer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Update' = '%APPDATA%\Internet Explorer.exe'
- %APPDATA%\Imminent\Logs\11-12-2017
- %APPDATA%\Microsoft\svchost.exe
- %TEMP%\internet explorer\internet explorer.exe
- %TEMP%\internet explorer\internet explorer.exe
- %APPDATA%\Internet Explorer.exe
- %APPDATA%\Internet Explorer.exe
- <Полный путь к файлу> в %APPDATA%\Internet Explorer.exe
- 'ar####ath.hopto.org':8886
- DNS ASK ar####ath.hopto.org
- '%TEMP%\internet explorer\internet explorer.exe'
- '%APPDATA%\Internet Explorer.exe'
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1000
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "%APPDATA%\Internet Explorer.exe"