Техническая информация
- '<SYSTEM32>\wbem\wmic.exe' os get * /format:list
- '<SYSTEM32>\wbem\wmic.exe' nic get * /format:list
- '<SYSTEM32>\qappsrv.exe'
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\qprocess.exe'
- '<SYSTEM32>\driverquery.exe'
- '<SYSTEM32>\wbem\wmic.exe' product get name,version
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\net1.exe' user
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\1.tmp.bat"
- '<SYSTEM32>\net1.exe' share
- '<SYSTEM32>\route.exe' print
- '<SYSTEM32>\tasklist.exe' /v
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\netstat.exe' -rn
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- <Текущая директория>\TempWmicBatchFile.bat
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %TEMP%\tmp2.tmp
- %TEMP%\1.tmp.bat
- %TEMP%\tmp3.tmp
- %TEMP%\tmp4.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\tmp4.tmp
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- 'we###ftdev.pw':80
- '20#.#6.232.182':80
- 'wp#d':80
- 20#.#6.232.182/pki/crl/products/CodeSignPCA2.crl
- 20#.#6.232.182/pki/crl/products/CSPCA.crl
- wp#d/wpad.dat
- DNS ASK we###ftdev.pw
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
- ClassName: '(null)' WindowName: '(null)'