Техническая информация
- '<SYSTEM32>\attrib.exe' -R -a -S -h <DRIVERS>\Etc\hoSts
- '<SYSTEM32>\cacls.exe' <DRIVERS>\eTc\hoSts /g everyone:f
- '<SYSTEM32>\cacls.exe' <DRIVERS>\etc\hosts /g everyone:r
- '<SYSTEM32>\attrib.exe' +r +a +s +h <DRIVERS>\etc\hosts
- '<SYSTEM32>\reg.exe' add "hKEY_cURRENt_USER\SOFtWaRE\MicROSOFt\WiNdOWS\cuRRENtVERSiON\iNtERNEt SEttiNgS" /v "DNScachEtiMEOut" /t "REG_DWORD" /d "0" /F
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\223F.tmp\nwe111111.bat" "
- '<SYSTEM32>\taskkill.exe' /F /IM conime.exe
- '<SYSTEM32>\reg.exe' add "hKEY_cURRENt_USER\SOFtWaRE\MicROSOFt\WiNdOWS\cuRRENtVERSiON\iNtERNEt SEttiNgS" /v "SERvERiNFOtiMEOut" /t "REG_DWORD" /d "0" /F
- C:\ProgramData\Microsoft\RAC\Temp\sqlEEC2.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlEE44.tmp
- %TEMP%\223F.tmp\nwe111111.bat
- <Текущая директория>\imeutil.exe
- <SYSTEM32>\Tasks\Microsoft\Windows Defender\MP Scheduled Scan
- C:\ProgramData\Microsoft\RAC\Temp\sqlEEC2.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlEE44.tmp
- <DRIVERS>\etc\hosts
- <Текущая директория>\imeutil.exe
- %TEMP%\223F.tmp\nwe111111.bat
- ClassName: '' WindowName: ''