Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\winlogon.exe
- %HOMEPATH%\Start Menu\Programs\Startup\svhost.vbs
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
- %TEMP%\去想家市想站家具我具.Bat
- %TEMP%\ZnxDpnFw.txt
- %TEMP%\dw.log
- %TEMP%\252F8.dmp
- <SYSTEM32>\rundll64.exe
- %TEMP%\306B8.dmp
- %TEMP%\4ob2saff.0.vb
- %TEMP%\4ob2saff.cmdline
- %TEMP%\4ob2saff.out
- %TEMP%\vbc1.tmp
- %TEMP%\vbc2.tmp
- %TEMP%\RES3.tmp
- 'localhost':333
- '89.##3.248.130':333
- '89.##3.248.130':1933
- '%TEMP%\去想家市想站家具我具.Bat'
- '<SYSTEM32>\rundll64.exe'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 392
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 388
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4ob2saff.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3.tmp" "%TEMP%\vbc2.tmp"