Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Nate' = '<SYSTEM32>\hosting.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Nate' = '<SYSTEM32>\astro.exe'
- <SYSTEM32>\hosting.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\test[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Cracked[1].exe
- <SYSTEM32>\astro.exe
- <SYSTEM32>\okir.system
- <SYSTEM32>\dllcache\okir.exe
- <SYSTEM32>\dllcache\okir.exe
- <SYSTEM32>\okir.system
- %TEMP%\~DFA19A.tmp
- 'le######.hosting.paran.com':80
- 'localhost':1036
- le######.hosting.paran.com/Cracked.exe
- le######.hosting.paran.com/test.exe
- DNS ASK le######.hosting.paran.com
- '<IP-адрес в локальной сети>':1037
- ClassName: '' WindowName: '??? ??'
- ClassName: '' WindowName: '??'
- ClassName: '' WindowName: 'Alyac'