Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\oreans32] 'Start' = '00000001'
- 'C:\Visual C++.exe'
- 'C:\Visual C++.exe' (загружен из сети Интернет)
- '<SYSTEM32>\msiexec.exe' /i "C:\MySQLConnector.msi"
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: '(null)'
- ClassName: 'OLLYDBG' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- ClassName: 'pediy06' WindowName: '(null)'
- C:\MySQLConnector.msi
- C:\Visual C++.exe
- <DRIVERS>\oreans32.sys
- 'go#.gl':80
- 'un#####kill.lolbb.com':80
- 'wp#d':80
- un#####kill.lolbb.com/h13-mendisstatusloaderprincipal
- un#####kill.lolbb.com/h23-mendisnovosemexe
- un#####kill.lolbb.com/h18-mendisredloaderprincipal
- go#.gl/Qq03sI
- go#.gl/WXtpM1
- un#####kill.lolbb.com/h24-mendisrednewloader
- wp#d/wpad.dat
- un#####kill.lolbb.com/h20-mendisantigo
- un#####kill.lolbb.com/h19-mendisstatusweapon2
- un#####kill.lolbb.com/h21-mendisnovo
- DNS ASK go#.gl
- DNS ASK un#####kill.lolbb.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'