Техническая информация
- '<SYSTEM32>\pdwhfbzhjza.exe'
- '%TEMP%\wgRun.exe'
- '%TEMP%\mttcnagwh.exe'
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.49##4.com/
- '<SYSTEM32>\findstr.exe' /i /b "mttcnagwh.exe"
- '<SYSTEM32>\attrib.exe' %TEMP%\mttcnagwh.exe.bat -r -a -s -h
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.bi##ge.com/
- '<SYSTEM32>\attrib.exe' %TEMP%\mttcnagwh.exe.bat -r -a +s +h
- '<SYSTEM32>\cmd.exe' /c %TEMP%\mttcnagwh.exe.bat
- '<SYSTEM32>\tasklist.exe'
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.55#.cn/
- ClassName: 'OLLYDBG' WindowName: '(null)'
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\49144[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\baidu[1]
- <SYSTEM32>\pdwhfbzhjza.exe
- %TEMP%\mttcnagwh.exe
- %TEMP%\wgRun.exe
- %TEMP%\mttcnagwh.exe.bat
- %TEMP%\mttcnagwh.exe
- 'localhost':1043
- 'localhost':1044
- 'www.49##4.com':80
- 'localhost':1038
- '12#.#25.114.144':80
- 'localhost':1042
- www.49##4.com/
- 12#.#25.114.144/
- DNS ASK www.49##4.com
- DNS ASK www.55#.cn
- DNS ASK www.ba##u.com
- DNS ASK www.bi##ge.com
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'