Техническая информация
- %WINDIR%\syswow64\dllhost.exe
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- %PROGRAMDATA%\windows.exe
- %TEMP%\nste1c.tmp
- %PROGRAMDATA%\setup.exe
- %TEMP%\nsye3c.tmp\nsexec.dll
- %TEMP%\nsye3c.tmp\repackme.gif
- %TEMP%\nsye3c.tmp\newadvsplash.dll
- %TEMP%\nsye3c.tmp\langdll.dll
- '91.##1.250.105':80
- ClassName: '18467-41' WindowName: ''
- '%PROGRAMDATA%\windows.exe'
- '%PROGRAMDATA%\setup.exe'
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="all" remoteip=95.141.193.133' (со скрытым окном)
- '%WINDIR%\syswow64\route.exe' delete 95.141.193.133' (со скрытым окном)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="all" remoteip=95.141.193.133
- '%WINDIR%\syswow64\route.exe' delete 95.141.193.133
- '%WINDIR%\syswow64\dllhost.exe'