Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\hfO2CuTNF3m] 'ImagePath' = '<DRIVERS>\hfO2CuTNF3m.sys'
- [<HKLM>\System\CurrentControlSet\Services\awoamqagfh] 'ImagePath' = '<DRIVERS>\QzrDl4a6.sys'
- 'hfO2CuTNF3m' <DRIVERS>\hfO2CuTNF3m.sys
- 'awoamqagfh' <DRIVERS>\QzrDl4a6.sys
- <SYSTEM32>\winlogon.exe
- iexplore.exe
- Процесс iexplore.exe, модуль wininet.dll
- Процесс firefox.exe, модуль wininet.dll
- Процесс firefox.exe, модуль mswsock.dll
- Процесс firefox.exe, модуль nss3.dll
- Процесс iexplore.exe, модуль mswsock.dll
- ClassName: 'OllyDbg', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- %WINDIR%\otalm.txt
- %WINDIR%\yewu05-1.db
- %WINDIR%\bitlockerdiscoveryvolumecontents\5552.tmp
- %WINDIR%\bitlockerdiscoveryvolumecontents\c_542403.nls
- %TEMP%\faeaf01863124e35f814ffd18a7be1ae3b75b.tmp
- %WINDIR%\softwaredistribution\7283.tmp
- %WINDIR%\softwaredistribution\c_871140.nls
- %WINDIR%\yewu06-2.db
- %WINDIR%\livekernelreports\8445.tmp
- %WINDIR%\livekernelreports\c_839757.nls
- <DRIVERS>\qzrdl4a6.sys
- %WINDIR%\pla\7283.tmp
- %WINDIR%\pla\c_870382.nls
- %WINDIR%\yewu100-1.db
- %WINDIR%\0189caa552598b845b29b17a427692d1.txt
- %WINDIR%\schemas\8060.tmp
- %WINDIR%\schemas\c_639806.nls
- %WINDIR%\l2schemas\hoiibgbcnaihkcnnhflfhkmhnoofgnkn\1.0.7\manifest.json
- %WINDIR%\l2schemas\hoiibgbcnaihkcnnhflfhkmhnoofgnkn\1.0.7\background.js
- %WINDIR%\l2schemas\hoiibgbcnaihkcnnhflfhkmhnoofgnkn\1.0.7\background.html
- %WINDIR%\installer\c_227192.nls
- %WINDIR%\l2schemas\hoiibgbcnaihkcnnhflfhkmhnoofgnkn\1.0.7\jquery.min.js
- %WINDIR%\installer\7283.tmp
- %WINDIR%\setup\7604.tmp
- %WINDIR%\media\7283.tmp
- %WINDIR%\media\c_435360.nls
- %WINDIR%\yewu99-2.db
- %WINDIR%\softwaredistribution\6384.tmp
- %WINDIR%\softwaredistribution\c_184866.nls
- %WINDIR%\performance\7283.tmp
- %WINDIR%\performance\c_435622.nls
- %WINDIR%\yewu02-1.db
- %WINDIR%\performance\6773.tmp
- %WINDIR%\performance\c_349727.nls
- <DRIVERS>\hfo2cutnf3m.sys
- %WINDIR%\logs\7283.tmp
- %WINDIR%\logs\c_497592.nls
- %WINDIR%\yewu03-1.db
- %WINDIR%\l2schemas\5549.tmp
- %WINDIR%\l2schemas\c_818809.nls
- %WINDIR%\addins\7283.tmp
- %WINDIR%\addins\c_412483.nls
- %WINDIR%\yewu04-2.db
- %WINDIR%\setup\c_561682.nls
- %WINDIR%\l2schemas\hoiibgbcnaihkcnnhflfhkmhnoofgnkn\1.0.7\lib\content.js
- %WINDIR%\media\c_435360.nls
- %WINDIR%\softwaredistribution\c_184866.nls
- %WINDIR%\performance\c_435622.nls
- %WINDIR%\performance\c_349727.nls
- %WINDIR%\logs\c_497592.nls
- %WINDIR%\l2schemas\c_818809.nls
- %WINDIR%\addins\c_412483.nls
- %WINDIR%\setup\c_561682.nls
- %WINDIR%\installer\c_227192.nls
- %WINDIR%\bitlockerdiscoveryvolumecontents\c_542403.nls
- %WINDIR%\softwaredistribution\c_871140.nls
- %WINDIR%\livekernelreports\c_839757.nls
- %WINDIR%\pla\c_870382.nls
- %WINDIR%\schemas\c_639806.nls
- %WINDIR%\media\7283.tmp
- %WINDIR%\yewu100-1.db
- %WINDIR%\pla\7283.tmp
- %WINDIR%\yewu06-2.db
- <DRIVERS>\qzrdl4a6.sys
- %WINDIR%\livekernelreports\8445.tmp
- %WINDIR%\softwaredistribution\7283.tmp
- %WINDIR%\yewu05-1.db
- %WINDIR%\bitlockerdiscoveryvolumecontents\5552.tmp
- %WINDIR%\installer\7283.tmp
- %WINDIR%\yewu04-2.db
- %WINDIR%\setup\7604.tmp
- %WINDIR%\addins\7283.tmp
- %WINDIR%\yewu03-1.db
- %WINDIR%\l2schemas\5549.tmp
- %WINDIR%\logs\7283.tmp
- %WINDIR%\yewu02-1.db
- <DRIVERS>\hfo2cutnf3m.sys
- %WINDIR%\performance\6773.tmp
- %WINDIR%\performance\7283.tmp
- %WINDIR%\yewu99-2.db
- %WINDIR%\softwaredistribution\6384.tmp
- %WINDIR%\schemas\8060.tmp
- %WINDIR%\0189caa552598b845b29b17a427692d1.txt
- <DRIVERS>\hfo2cutnf3m.sys
- 'nq#####z.slt.cdntip.com':80
- http://li##.##icoou.com:6666/8352456bf58aff9b4b75664abf76bb09.txt via li##.#dicoou.com
- http://sp#.#aidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?qu##############################################################
- http://do##.onefast.cc/cfg/user/c995ec7fd4f57c0d/f141b838c70f0d8b.json
- http://do##.onefast.cc/cfg/pub/ms.json
- http://do##.onefast.cc/cfg/pub/ps.json
- http://11#.#29.33.201/report.php?ty##############################################################################################################################################################...
- http://do##.onefast.cc/pgm/mds/05631e93ccdb00ee/f79e9e12124babd5af4c1b226d63c8b1d4c9fdaf5400655e64.zip
- http://do##.onefast.cc/pgm/mds/006866ef1b75dc55/48293f91dddad83d562d32d4d55d7e272076b5ebcb6d286164.zip
- http://do##.onefast.cc/cfg/cmc/nmlhjk.txt
- http://do##.onefast.cc/cfg/cmc/wea.txt
- http://do##.onefast.cc/cfg/cmc/slfdm.txt
- http://11#.#29.33.201/report/report_data?da######################################################################################################################################################...
- http://do##.onefast.cc/cfg/cmc/qzpass.txt
- http://do##.onefast.cc/cfg/cmc/b2.txt
- http://do##.onefast.cc/pgm/mds/422ed73a26bc994c/8f6b181e9acd608997be30b44587702c5fa71ab95043b48164.zip
- http://do##.onefast.cc/cfg/cmc/sfbd.txt
- http://12#.#1.239.87/report.php?da###############################################################################################################################################################...
- http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
- http://61.###.11.20:50302/fba722c08ffaabc0efc84bf2bdbb473f.zip
- http://ap#.uf1.cn/v5/box/32/10177573/0
- http://61.###.11.20:50820/4c3a7dc93a2ec481cf6f05e4d78ffafa.zip
- http://61.###.11.20:50590/ok.txt?50###
- http://61.###.11.20:6666/ca51d8c89d200ab1433893d812b71fed.exe
- http://47.##.189.44:7890/0a0027000024.txt via 47.##.189.44
- http://61.###.11.20:50638/1a1571979b35f6dcd6ff7e083c5547f1.zip
- http://17#.#76.195.126/fen/999/1.asp?us##################################################################################################
- http://61.###.11.20:50063/c02bf9affd20aea20fca56431d7915d2.zip
- http://cn.bing.com/
- http://61.###.11.20:50115/9261b3f5cf27dc0384cab9760584b863.zip
- http://do##.onefast.cc/cfg/cmc/userpq.zip
- http://17#.#76.195.126/fen/999/1.asp?us##################################################################################################################
- http://61.###.11.20:50004/6a2e57d60d1494c67395ee0c704ab342.zip
- http://ti####ic.baidu.com/tieba/pic/item/d6ca7bcb0a46f21f7aa10208e1246b600d33aed0.jpg
- http://61.###.11.20:50576/1d248c92e8230d5c56a2b8e3d360dbf1.zip
- http://do##.onefast.cc/pgm/mpr/c995ec7fd4f57c0d/f141b838c70f0d8b.zip
- http://20####.ip138.com/
- http://ap#.#bbtv.xyz/c.php?pi###################################
- http://ap#.#bbtv.xyz/m.php?md##########################################################
- http://do##.onefast.cc/cfg/cmc/chct.txt
- DNS ASK J7#####p.gdicoou.com
- DNS ASK ap#.uf1.cn
- DNS ASK hz.###anqi699.vip
- DNS ASK 9.##c81.top
- DNS ASK nm#####.hjkl45678.xyz
- DNS ASK 95##.eic81.top
- DNS ASK cl####.vbnm34567.xyz
- DNS ASK sp#.#aidu.com
- DNS ASK ap##.#ame.qq.com
- DNS ASK sd#####gfg.xyzs666.xyz
- DNS ASK mp####.hjkl45678.xyz
- DNS ASK 20####.ip138.com
- DNS ASK lo#.#nefast.cc
- DNS ASK do##.####ast.cc.cdn.dnsv1.com
- DNS ASK do##.onefast.cc
- DNS ASK ti####ic.baidu.com
- DNS ASK li##.#dicoou.com
- DNS ASK cn.bing.com
- DNS ASK nq#####z.slt.cdntip.com
- DNS ASK ap#.#bbtv.xyz
- '<LOCALNET>.36.178':50756
- '<LOCALNET>.36.170':18252
- '<LOCALNET>.36.165':19533
- '<LOCALNET>.36.166':15408
- '<LOCALNET>.36.167':11279
- '<LOCALNET>.36.177':14251
- '<LOCALNET>.36.172':26382
- '<LOCALNET>.36.168':62837
- '<LOCALNET>.36.171':22381
- '<LOCALNET>.36.173':30511
- '<LOCALNET>.36.174':12093
- '<LOCALNET>.36.181':18259
- '<LOCALNET>.36.169':58708
- '<LOCALNET>.36.180':22386
- '<LOCALNET>.36.190':25667
- '<LOCALNET>.36.182':30512
- '<LOCALNET>.36.183':26385
- '<LOCALNET>.36.184':16235
- '<LOCALNET>.36.185':12108
- '<LOCALNET>.36.186':14260
- '<LOCALNET>.36.187':10133
- '<LOCALNET>.36.188':54906
- '<LOCALNET>.36.189':50779
- '<LOCALNET>.36.175':16222
- '<LOCALNET>.36.191':29794
- '<LOCALNET>.36.192':17409
- '<LOCALNET>.36.179':54885
- '<LOCALNET>.36.194':19516
- '<LOCALNET>.36.164':13561
- '<LOCALNET>.36.176':10122
- '<LOCALNET>.36.156':16872
- '<LOCALNET>.36.160':29821
- '<LOCALNET>.36.135':56109
- '<LOCALNET>.36.136':60238
- '<LOCALNET>.36.137':64367
- '<LOCALNET>.36.138':12789
- '<LOCALNET>.36.139':16918
- '<LOCALNET>.36.140':14740
- '<LOCALNET>.36.141':10675
- '<LOCALNET>.36.142':12893
- '<LOCALNET>.36.143':18929
- '<LOCALNET>.36.144':21147
- '<LOCALNET>.36.145':17082
- '<LOCALNET>.36.162':21567
- '<LOCALNET>.36.133':48107
- '<LOCALNET>.36.146':29401
- '<LOCALNET>.36.149':33590
- '<LOCALNET>.36.150':18595
- '<LOCALNET>.36.151':12559
- '<LOCALNET>.36.152':10465
- '<LOCALNET>.36.153':14530
- '<LOCALNET>.36.154':25002
- '<LOCALNET>.36.155':29067
- '<LOCALNET>.36.197':15385
- '<LOCALNET>.36.157':20937
- '<LOCALNET>.36.158':40998
- '<LOCALNET>.36.159':45063
- '<LOCALNET>.36.193':21536
- '<LOCALNET>.36.147':25336
- '<LOCALNET>.36.148':37655
- '<LOCALNET>.36.161':25692
- '<LOCALNET>.36.163':17438
- '<LOCALNET>.36.196':11258
- '<LOCALNET>.36.206':59213
- '<LOCALNET>.36.198':58699
- '<LOCALNET>.36.232':62106
- '<LOCALNET>.36.233':58043
- '<LOCALNET>.36.234':37468
- '<LOCALNET>.36.235':33405
- '<LOCALNET>.36.236':45598
- '<LOCALNET>.36.237':41535
- '<LOCALNET>.36.238':21456
- '<LOCALNET>.36.239':17393
- '<LOCALNET>.36.240':19279
- '<LOCALNET>.36.241':23406
- '<LOCALNET>.36.242':27405
- '<LOCALNET>.36.243':31532
- '<LOCALNET>.36.244':13120
- '<LOCALNET>.36.231':49913
- '<LOCALNET>.36.245':17247
- '<LOCALNET>.36.247':15272
- '<LOCALNET>.36.248':51783
- '<LOCALNET>.36.249':55910
- '<LOCALNET>.36.250':30846
- '<LOCALNET>.36.251':26719
- '<LOCALNET>.36.252':22588
- '<LOCALNET>.36.253':18461
- '<LOCALNET>.36.254':14586
- '23#.#23.112.211':47051
- '47.##.189.44':8081
- '<LOCALNET>.36.255':18693
- '47.##.189.44':7890
- '<LOCALNET>.36.229':28864
- '<LOCALNET>.36.246':11145
- '<LOCALNET>.36.195':13542
- '<LOCALNET>.36.226':33071
- '<LOCALNET>.36.128':14769
- '<LOCALNET>.36.199':62826
- '<LOCALNET>.36.200':34699
- '<LOCALNET>.36.201':38826
- '<LOCALNET>.36.202':42953
- '<LOCALNET>.36.203':47080
- '<LOCALNET>.36.204':50959
- '<LOCALNET>.36.205':55086
- '<LOCALNET>.36.134':51980
- '<LOCALNET>.36.207':63340
- '<LOCALNET>.36.208':11768
- '<LOCALNET>.36.209':15895
- '<LOCALNET>.36.210':46266
- '<LOCALNET>.36.211':42139
- '<LOCALNET>.36.212':38136
- '<LOCALNET>.36.213':34009
- '<LOCALNET>.36.214':62526
- '<LOCALNET>.36.215':58399
- '<LOCALNET>.36.216':54396
- '<LOCALNET>.36.217':50269
- '<LOCALNET>.36.218':13746
- '<LOCALNET>.36.96':35045
- '<LOCALNET>.36.220':57833
- '<LOCALNET>.36.221':61896
- '<LOCALNET>.36.222':49579
- '<LOCALNET>.36.223':53642
- '<LOCALNET>.36.224':41325
- '<LOCALNET>.36.225':45388
- '<LOCALNET>.36.227':37134
- '<LOCALNET>.36.132':43978
- '<LOCALNET>.36.230':53976
- '<LOCALNET>.36.131':39849
- '47.##.119.96':21785
- '<LOCALNET>.36.129':10640
- '<LOCALNET>.36.36':26414
- '<LOCALNET>.36.37':30479
- '<LOCALNET>.36.38':34528
- '<LOCALNET>.36.39':38593
- '<LOCALNET>.36.40':40575
- '<LOCALNET>.36.41':36446
- '<LOCALNET>.36.42':48701
- '<LOCALNET>.36.43':44572
- '<LOCALNET>.36.44':57083
- '<LOCALNET>.36.45':52954
- '<LOCALNET>.36.46':65209
- '<LOCALNET>.36.33':14219
- '<LOCALNET>.36.47':61080
- '<LOCALNET>.36.35':22349
- '<LOCALNET>.36.49':14027
- '<LOCALNET>.36.51':48495
- '<LOCALNET>.36.52':36108
- '<LOCALNET>.36.53':40237
- '<LOCALNET>.36.54':60874
- '<LOCALNET>.36.55':65003
- '<LOCALNET>.36.63':51326
- '<LOCALNET>.36.57':56745
- '<LOCALNET>.36.58':11334
- '<LOCALNET>.36.59':15463
- '<LOCALNET>.36.60':63517
- '<LOCALNET>.36.61':59452
- '<LOCALNET>.36.48':18156
- '<LOCALNET>.36.32':10154
- '<LOCALNET>.36.50':44366
- '<LOCALNET>.36.31':16190
- '<LOCALNET>.36.56':52616
- '255.255.255.255':17173
- '<LOCALNET>.36.13':20969
- '<LOCALNET>.36.12':16840
- '<LOCALNET>.36.11':29099
- '<LOCALNET>.36.10':24970
- '<LOCALNET>.36.9':38435
- '<LOCALNET>.36.8':34306
- '<LOCALNET>.36.4':18318
- '<LOCALNET>.36.6':26572
- '<LOCALNET>.36.5':22447
- '<LOCALNET>.36.3':14185
- '<LOCALNET>.36.2':20157
- '<LOCALNET>.36.14':18563
- '<LOCALNET>.36.7':30701
- '<LOCALNET>.36.15':12591
- '<LOCALNET>.36.26':21535
- '<LOCALNET>.36.17':14562
- '<LOCALNET>.36.18':57474
- '<LOCALNET>.36.19':61603
- '<LOCALNET>.36.20':13529
- '<LOCALNET>.36.21':19565
- '<LOCALNET>.36.22':15376
- '<LOCALNET>.36.23':11311
- '<LOCALNET>.36.24':29789
- '<LOCALNET>.36.1':16032
- '<LOCALNET>.36.27':17470
- '<LOCALNET>.36.28':46545
- '<LOCALNET>.36.29':42480
- '<LOCALNET>.36.62':55391
- '<LOCALNET>.36.16':10433
- '<LOCALNET>.36.30':12125
- '<LOCALNET>.36.64':47257
- '<LOCALNET>.36.107':44604
- '<LOCALNET>.36.99':30986
- '<LOCALNET>.36.101':52986
- '<LOCALNET>.36.102':65177
- '<LOCALNET>.36.103':61112
- '<LOCALNET>.36.104':40543
- '<LOCALNET>.36.105':36478
- '<LOCALNET>.36.106':48669
- '<LOCALNET>.36.34':18284
- '<LOCALNET>.36.108':24531
- '<LOCALNET>.36.109':20466
- '<LOCALNET>.36.110':60906
- '<LOCALNET>.36.111':64971
- '<LOCALNET>.36.112':52648
- '<LOCALNET>.36.113':56713
- '<LOCALNET>.36.114':44398
- '<LOCALNET>.36.115':48463
- '<LOCALNET>.36.116':36140
- '<LOCALNET>.36.117':40205
- '<LOCALNET>.36.118':27874
- '<LOCALNET>.36.119':31939
- '<LOCALNET>.36.120':47289
- '<LOCALNET>.36.121':43160
- '<LOCALNET>.36.228':24801
- '<LOCALNET>.36.123':35034
- '<LOCALNET>.36.124':63549
- '<LOCALNET>.36.125':59420
- '<LOCALNET>.36.126':55423
- '<LOCALNET>.36.127':51294
- '<LOCALNET>.36.98':26923
- '<LOCALNET>.36.65':43192
- '<LOCALNET>.36.100':57051
- '<LOCALNET>.36.219':19720
- '<LOCALNET>.36.130':35720
- '<LOCALNET>.36.95':47238
- '<LOCALNET>.36.67':35066
- '<LOCALNET>.36.68':30997
- '<LOCALNET>.36.69':26932
- '<LOCALNET>.36.70':52012
- '<LOCALNET>.36.71':56077
- '<LOCALNET>.36.72':60270
- '<LOCALNET>.36.73':64335
- '<LOCALNET>.36.74':35752
- '<LOCALNET>.36.75':39817
- '<LOCALNET>.36.76':44010
- '<LOCALNET>.36.77':48075
- '<LOCALNET>.36.78':18980
- '<LOCALNET>.36.79':23045
- '<LOCALNET>.36.66':39131
- '<LOCALNET>.36.80':56082
- '<LOCALNET>.36.82':64336
- '<LOCALNET>.36.83':60273
- '<LOCALNET>.36.84':39830
- '<LOCALNET>.36.85':35767
- '<LOCALNET>.36.86':48084
- '<LOCALNET>.36.87':44021
- '<LOCALNET>.36.88':23066
- '<LOCALNET>.36.89':19003
- '<LOCALNET>.36.90':59427
- '<LOCALNET>.36.91':63490
- '<LOCALNET>.36.92':51297
- '<LOCALNET>.36.93':55360
- '<LOCALNET>.36.94':43175
- '<LOCALNET>.36.81':52019
- '<LOCALNET>.36.97':39108
- '<LOCALNET>.36.122':39163
- ClassName: 'ProgMan' WindowName: ''
- ClassName: 'WinObjWClass' WindowName: ''
- ClassName: '91yGamePlaza' WindowName: ''
- ClassName: 'Net77_GamePlaza' WindowName: ''
- ClassName: 'YouYouGamePlaza' WindowName: ''
- ClassName: '850GamePlaza' WindowName: ''
- ClassName: '#32770' WindowName: '²¨¿Ë³ÇÊÐ'
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'Qt5QWindowIcon' WindowName: 'JJ±ÈÈü´óÌü'
- ClassName: 'GLFW30' WindowName: '92yÓÎÏ·'
- ClassName: 'JQFRAME' WindowName: ''
- ClassName: 'HallMainWnd' WindowName: ''
- ClassName: '2978' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'jjhgame' WindowName: ''
- ClassName: 'dbgviewClass' WindowName: ''
- '%WINDIR%\livekernelreports\c_839757.nls'
- '%WINDIR%\schemas\c_639806.nls'
- '<SYSTEM32>\ipconfig.exe' /flushdns' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (со скрытым окном)
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Полный путь к файлу>"
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\explorer.exe"