Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\DNSSVC] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\spool\drivers\DNSsvc.exe' = '<SYSTEM32>\spool\drivers\DNSsvc.exe:*:enabled:Explorer'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\spool\drivers\DNSsvc.exe' = '<SYSTEM32>\spool\drivers\DNSsvc.exe:*:enabled:Explorer'
- <SYSTEM32>\spool\drivers\DNSsvc.exe /Start
- <SYSTEM32>\cmd.exe /c C:\DNS_AUTO_DELETE.BAT
- C:\DNS_AUTO_DELETE.BAT
- <SYSTEM32>\spool\driversDNS_TEMP_CONFIG.INI
- <Текущая директория>DNS_TEMP_CONFIG.INI
- <SYSTEM32>\spool\drivers\DNSsvc.exe
- <SYSTEM32>\spool\driversDNS_TEMP_CONFIG.INI
- <Текущая директория>DNS_TEMP_CONFIG.INI
- 'www.hi######developments.com':80
- www.hi######developments.com/ptmp2.php
- DNS ASK www.hi######developments.com
- '<IP-адрес в локальной сети>':1037