Техническая информация
- %WINDIR%\syswow64\displayswitch.exe
- 'zw#.##100.online':80
- http://47.##.164.83/index.php/inface/Heart/getConfigDyn?m_###############################################
- DNS ASK zw#.##100.online
- '<LOCALNET>.37.62':56228
- '<LOCALNET>.37.62':56227
- '<LOCALNET>.37.62':56226
- '<LOCALNET>.37.62':56225
- '<LOCALNET>.37.62':56224
- '<LOCALNET>.37.62':56223
- '<LOCALNET>.37.62':56222
- '<LOCALNET>.37.62':56221
- '<LOCALNET>.37.62':56220
- '<LOCALNET>.37.62':56219
- '<LOCALNET>.37.62':56218
- '<LOCALNET>.37.62':56217
- '<LOCALNET>.37.62':56216
- '<LOCALNET>.37.62':56215
- '<LOCALNET>.37.62':56214
- '<LOCALNET>.37.62':56213
- '<LOCALNET>.37.62':56212
- '<LOCALNET>.37.62':56211
- '<LOCALNET>.37.62':56210
- '<LOCALNET>.37.62':56209
- '<LOCALNET>.37.62':56208
- '<LOCALNET>.37.62':56207
- '<LOCALNET>.37.62':63892
- '255.255.255.255':23881
- '255.255.255.255':23779
- '<LOCALNET>.37.62':56229
- '<LOCALNET>.37.62':56230
- '<SYSTEM32>\svchost.exe' -k LocalServiceNetwork -p
- '%WINDIR%\syswow64\charmap.exe'
- '%WINDIR%\syswow64\displayswitch.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\charmap.exe"