Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Security' = 'C:\ProgramData\wmdefender.exe'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\71282] 'Name' = '%TEMP%\1831.tmp'
- 'C:\ProgramData\wmdefender.exe'
- '<SYSTEM32>\wermgr.exe' 0x9d4 dllhost.exe
- '<SYSTEM32>\conhost.exe' /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
- '<SYSTEM32>\wermgr.exe' "-queuereporting_svc" "C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.exe_1877e357d65d23a5d935fe86732997386396fda_cab_09ef4ae4"
- <SYSTEM32>\spoolsv.exe
- <Служебный элемент>
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- C:\Users\Public\Desktop\Internet Security Pro.lnk
- <Служебный элемент>
- C:\ProgramData\wmdefender
- %TEMP%\1831.tmp
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.exe_1877e357d65d23a5d935fe86732997386396fda_cab_09ef4ae4\Report.wer.tmp в C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.exe_1877e357d65d23a5d935fe86732997386396fda_cab_09ef4ae4\Report.wer
- C:\ProgramData\wmdefender в C:\ProgramData\wmdefender.exe
- DNS ASK ci###myn.com
- DNS ASK me#####wnloadgroup.com
- DNS ASK tw###cam.net
- DNS ASK dn#.##ftncsi.com
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''