Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\orderedbattery] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\orderedbattery] 'ImagePath' = '"%WINDIR%\SysWOW64\orderedbattery.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAARwB2AHgAcgBrAGsAZAB2AHoAbwAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGQAYgBqAHYAcgBiAHkAeQB5AHkAaQBlACAAIwA+ACAAJABKAGcAagBiAGQAawB0AHkAPQAnAEoAdQ...
- %HOMEPATH%\108.exe
- %PROGRAMDATA%\cvxgdfade.sxcase
- %HOMEPATH%\108.exe в %WINDIR%\syswow64\orderedbattery.exe
- '19#.#41.220.155':8080
- http://ma#####monkeymedia.com/wp-includes/ydrRQ7on/
- http://sh##.#odaiaodai.com/by8egnc/CsxqJn/
- http://19#.###.220.155:8080/prov/dma/ringin/merge/
- DNS ASK ma#####monkeymedia.com
- DNS ASK ta####osmetics.com
- DNS ASK sh##.#odaiaodai.com
- '%HOMEPATH%\108.exe'
- '%WINDIR%\syswow64\orderedbattery.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAARwB2AHgAcgBrAGsAZAB2AHoAbwAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGQAYgBqAHYAcgBiAHkAeQB5AHkAaQBlACAAIwA+ACAAJABKAGcAagBiAGQAawB0AHkAPQAnAEoAdQ...' (со скрытым окном)