Техническая информация
- <SYSTEM32>\tasks\windows\recovery\cleaner
- %WINDIR%\syswow64\attrib.exe
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- из <Полный путь к файлу> в %PROGRAMDATA%\iostream.exe
- DNS ASK lg#####gjlvaf.hopto.org
- ClassName: '18467-41' WindowName: ''
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\Recovery\Cleaner /tr "%PROGRAMDATA%\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f' (со скрытым окном)
- '%PROGRAMDATA%\iostream.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\Recovery\Cleaner /tr "%PROGRAMDATA%\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f
- '<SYSTEM32>\taskeng.exe' {7426E8BC-8E8F-4B15-9541-218EA75F7D5B} S-1-5-21-1960123792-2022915161-3775307078-1001:btjpvzigw\user:Interactive:[1]
- '%WINDIR%\syswow64\attrib.exe'