Техническая информация
- <SYSTEM32>\tasks\hostdatafile
- %APPDATA%\hostdata\syxt\sysdata.exe
- %APPDATA%\hostdata\install.dat
- %TEMP%\content\5712-5700-<Имя файла>.exe-17-43-40-482.dump
- %APPDATA%\hostdata\syxt\diagsvc.dll
- %APPDATA%\hostdata\syxt\sdrsvc.dll
- %APPDATA%\hostdata\syxt\sysdata.vbs
- %APPDATA%\hostdata\path.dat
- %TEMP%\g71scbx7.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<Имя файла>.exe.log
- nul
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\sysdata.exe.log
- DNS ASK ap#.#pify.org
- DNS ASK ip##.#canhazip.com
- DNS ASK v4.#dent.me
- '%APPDATA%\hostdata\syxt\sysdata.exe'
- '<SYSTEM32>\schtasks.exe' /Create /TN "HostDataFile" /TR "\"wscript.exe\" //nologo \"%APPDATA%\HostData\syxt\sysdata.vbs\"" /SC MINUTE /MO 10 /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\g71scbx7.bat""
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
- '<SYSTEM32>\schtasks.exe' /Delete /TN "HostDataPath" /F
- '<SYSTEM32>\schtasks.exe' /Query /TN "HostDataFile"