Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\.mrxsmb] 'ImagePath' = '\?'
- Центр обеспечения безопасности (Security Center)
- '<SYSTEM32>\cmd.exe'
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
- '21#.#08.252.185':80
- 'pr####.fling.com':80
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################ via 21#.#08.252.185
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th############################### via 21#.#08.252.185
- http://pr####.fling.com/geo/txt/city.php
- DNS ASK ޡc#1M
- DNS ASK ޡc#�%�
- DNS ASK ޡc#��3
- DNS ASK ޡc#X�@
- DNS ASK ޡc#ɴ
- DNS ASK ޡc#��:
- DNS ASK ޡc#�y�
- DNS ASK ޡc#(
- DNS ASK pr####.fling.com
- DNS ASK ޡc#V��
- DNS ASK ޡc#�o�
- DNS ASK ޡc#s
- '50.##.143.58':16471
- '11#.#11.5.68':16471
- '66.##.218.71':16471
- '21#.#51.196.188':16471
- '68.##.124.184':16471
- '95.##.92.184':16471
- '21#.#1.245.180':16471
- '17#.#3.250.177':16471
- '70.##.212.73':16471
- '68.##9.124.177':16471
- '2.###.249.179':16471
- '72.##0.52.72':16471
- '69.##2.5.179':16471
- '68.#3.3.200':16471
- '18#.#62.68.50':16471
- '92.##8.179.51':16471
- '62.##3.12.202':16471
- '98.##6.205.201':16471
- '24.##.144.201':16471
- '2.##.135.196':16471
- '78.##3.108.55':16471
- '70.##.216.57':16471
- '20#.#34.6.58':16471
- '20#.#5.77.195':16471
- '84.##2.224.53':16471
- '78.#9.53.55':16471
- '89.##9.24.177':16471
- '27.##6.50.159':16471
- '82.##.182.158':16471
- '81.##.162.158':16471
- '11#.#80.109.160':16471
- '24.##9.133.159':16471
- '78.##9.51.159':16471
- '82.##.100.156':16471
- '79.##8.177.148':16471
- '24.##7.246.146':16471
- '70.##.52.146':16471
- '11#.#62.172.155':16471
- '24.##3.80.154':16471
- '75.##1.40.154':16471
- '89.##.233.168':16471
- '21#.#7.198.168':16471
- '75.##.231.167':16471
- '24.##7.233.172':16471
- '10#.#70.246.170':16471
- '11#.#11.197.170':16471
- '50.##.194.167':16471
- '12#.#16.44.165':16471
- '75.##5.44.162':16471
- '18#.#6.217.160':16471
- '72.##0.175.167':16471
- '86.##6.61.167':16471
- '74.##7.38.166':16471
- '24.##.29.202':16471
- '17#.#81.104.18':16471
- '68.##6.175.18':16471
- '11#.#4.182.225':16471
- '10#.#3.115.13':16471
- '17#.#30.96.229':16471
- '22#.#36.170.13':16471
- '77.##.234.20':16471
- '70.##8.124.23':16471
- '18#.#.110.24':16471
- '76.##7.252.27':16471
- '17#.#99.134.22':16471
- '76.##9.60.222':16471
- '24.##.122.221':16471
- '70.##7.49.240':16471
- '27.##.23.236':16471
- '18#.#60.40.235':16471
- '12#.#11.104.243':16471
- '50.##2.84.242':16471
- '24.#.251.240':16471
- '17#.#.178.234':16471
- '98.##3.177.231':16471
- '85.##2.179.10':16471
- '80.##.100.11':16471
- '10#.#76.96.233':16471
- '42.##1.221.5':16471
- '90.#.185.8':16471
- '17#.#1.233.219':16471
- '66.##6.90.46':16471
- '36.#.209.46':16471
- '11#.#43.148.205':16471
- '81.##1.141.45':16471
- '69.##2.201.45':16471
- '20#.#02.196.205':16471
- '11#.#01.220.46':16471
- '17#.#8.184.203':16471
- '18#.#0.77.203':16471
- '50.##.237.49':16471
- '17#.#1.14.47':16471
- '11#.#02.17.48':16471
- '10#.#.13.204':16471
- '84.##7.224.217':16471
- '68.#0.81.31':16471
- '89.##.106.35':16471
- '83.##6.119.28':16471
- '18#.#32.162.29':16471
- '95.#6.11.30':16471
- '50.#.126.37':16471
- '24.#.156.41':16471
- '84.#.173.41':16471
- '66.##7.14.42':16471
- '99.##9.22.41':16471
- '61.##.231.209':16471
- '19#.#85.176.209':16471