Техническая информация
- '<SYSTEM32>\ipseccmd.exe' -w REG -p "IP Security Policy" -x
- '<SYSTEM32>\ipseccmd.exe' import REG %WINDIR%\Games.inf
- '<SYSTEM32>\ipseccmd.exe' (загружен из сети Интернет)
- '<SYSTEM32>\net1.exe' start policyagent
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\net.exe' stop policyagent
- '<SYSTEM32>\net1.exe' stop policyagent
- %WINDIR%\Games.inf
- <SYSTEM32>\ipseccmd.exe
- %TEMP%\~DF707C.tmp
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- <DRIVERS>\etc\hosts
- %WINDIR%\Games.inf
- '27.##4.52.173':80
- 'localhost':1037
- http://27.##4.52.173/Games.inf
- http://27.##4.52.173/cmd.inf
- ClassName: 'Shell_TrayWnd' WindowName: ''