Техническая информация
- '%TEMP%\cfe.exe'
- '%TEMP%\cfe_2.exe' -pcfe -d%HOMEPATH%\Local Settings\Temp
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cfe.bat" "
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- <SYSTEM32>\iDLL_1.dll
- <SYSTEM32>\iDLL_2.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\chitachok[1]
- %TEMP%\cfe.bat
- %TEMP%\cfe_2.exe
- %TEMP%\cfe.exe
- 'ch###chok.ru':80
- 'pb##ck.ru':80
- 'localhost':1036
- ch###chok.ru/
- DNS ASK ch###chok.ru
- DNS ASK pb##ck.ru
- ClassName: '' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'