Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\GrayPigeon_Hacker.com.cn] 'Start' = '00000002'
- '%WINDIR%\Hacker.com.cn.exe'
- 'C:\旋舞丗傢第九修复版.exe'
- 'C:\Server_Setup.exe'
- '<SYSTEM32>\rundll32.exe' url.dll,FileProtocolHandler www.52##t.com
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\uninstal.bat
- <SYSTEM32>\sj.dll
- C:\SkinH_EL.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\52blt[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fz[1].html
- <DRIVERS>\kiss.she
- C:\旋舞丗傢第九修复版.exe
- C:\Server_Setup.exe
- %WINDIR%\uninstal.bat
- %WINDIR%\Hacker.com.cn.exe
- %WINDIR%\Hacker.com.cn.exe
- C:\Server_Setup.exe
- 'localhost':1039
- 'www.52##t.com':80
- 'www.x5##.com':80
- 'localhost':1035
- '12#.#31.143.20':8000
- www.52##t.com/
- www.x5##.com/zb/fz.html
- DNS ASK www.52##t.com
- DNS ASK www.x5##.com
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'