Техническая информация
- '<LS_APPDATA>\ContextTrue\ContextTrue.exe'
- '<LS_APPDATA>\ContextTrue\nvhlpr.exe' -godirectly -quitafter -bat -ping -part 20032 -soft null
- '%TEMP%\nsh2.tmp\ns3.tmp' "<LS_APPDATA>\ContextTrue\decrypt.bat" /f >nul
- '<LS_APPDATA>\ContextTrue\Ncrypt.exe' -SF 123456789ABCDEF12345 CntxtTr.tome ContextTrue.exe
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\cmd.exe' /c ""<LS_APPDATA>\ContextTrue\decrypt.bat" /f >nul"
- <LS_APPDATA>\ContextTrue\ContextTrue_Uninstaller.exe
- %TEMP%\nss5.tmp\System.dll
- <LS_APPDATA>\ContextTrue\ContextTrue.exe
- <LS_APPDATA>\ContextTrue\nvhlpr.exe
- <LS_APPDATA>\ContextTrue\windoclib.exe
- <LS_APPDATA>\ContextTrue\notifications.exe
- <LS_APPDATA>\ContextTrue\cnthlpr.exe
- <LS_APPDATA>\ContextTrue\Ncrypt.exe
- <LS_APPDATA>\ContextTrue\CntxtTr.tome
- %TEMP%\nsh2.tmp\System.dll
- <LS_APPDATA>\ContextTrue\decrypt.bat
- %TEMP%\nsh2.tmp\ns3.tmp
- %TEMP%\nsh2.tmp\nsExec.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\nsh2.tmp\ns3.tmp
- %TEMP%\nsh2.tmp\nsExec.dll
- '74.##5.232.51':80
- 'in####activity.net':80
- 'ma###ttizer.net':80
- 'go##le.es':80
- 'tw##ter.com':80
- 'fa##book.es':80
- 'fa###ook.com':80
- ma###ttizer.net/as/ext/Ping
- DNS ASK google.com
- DNS ASK in####activity.net
- DNS ASK ma###ttizer.net
- DNS ASK go##le.es
- DNS ASK tw##ter.com
- DNS ASK fa##book.es
- DNS ASK fa###ook.com