Техническая информация
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 2872
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- <SYSTEM32>\logfiles\httperr\httperr1.log
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
- http://93.###.20.87:6677/IRemotePanel via 93.##5.20.87
- DNS ASK ch#####.amazonaws.com
- DNS ASK ge###ugin.net
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 2872 && choice /C Y /N /D Y /T 3 & Del "<Полный путь к файлу>"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3