Техническая информация
- <SYSTEM32>\tasks\hostdataconfig
- %APPDATA%\hostdata\ogfp\sysdata.exe
- %APPDATA%\hostdata\install.dat
- %TEMP%\content\5124-5492-<Имя файла>.exe-18-05-12-111.dump
- %APPDATA%\hostdata\ogfp\diagsvc.dll
- %APPDATA%\hostdata\ogfp\sdrsvc.dll
- %APPDATA%\hostdata\ogfp\sysdata.vbs
- %APPDATA%\hostdata\path.dat
- %TEMP%\qr0nszje.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<Имя файла>.exe.log
- nul
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\sysdata.exe.log
- DNS ASK ap#.#pify.org
- DNS ASK ip##.#canhazip.com
- DNS ASK v4.#dent.me
- DNS ASK fi#####.###tings.services.mozilla.com
- '%APPDATA%\hostdata\ogfp\sysdata.exe'
- '<SYSTEM32>\schtasks.exe' /Create /TN "HostDataConfig" /TR "\"wscript.exe\" //nologo \"%APPDATA%\HostData\ogfp\sysdata.vbs\"" /SC MINUTE /MO 10 /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qr0nszje.bat""
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
- '<SYSTEM32>\schtasks.exe' /Delete /TN "HostDataPath" /F
- '<SYSTEM32>\schtasks.exe' /Query /TN "HostDataConfig"