Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\driversend] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\driversend] 'ImagePath' = '"%WINDIR%\SysWOW64\driversend.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABHAGYAbwBjAG4AZgB1AHoAdABxAD0AJwBFAGQAbgBtAHcAbgBpAHAAaQBrACcAOwAkAE0AcAB0AGYAZgBhAGYAcwB1AHgAeQAgAD0AIAAnADMANgAzACcAOwAkAFEAcgByAHQAbQBrAGsAeABrAD0AJwBYAGcAcABlAGkAbwBzAHoAZgB...
- %HOMEPATH%\363.exe
- %HOMEPATH%\363.exe в %WINDIR%\syswow64\driversend.exe
- http://www.vg##h.com/wp-admin/Ch9wxSq/
- http://19#.#31.167.50/ooBbJQWldmt7
- http://68.##4.15.223/DhbYWma3ncal
- http://72.##.55.174/R6tKH5mTE
- http://19#.##1.143.52:8080/nZ4c6FDkutGM via 19#.#41.143.52
- http://15#.##.241.220:8080/RgLUR5qIdt1QhKx7v via 15#.#5.241.220
- http://45.##.95.107:443/4hIe9eyQXHZh via 45.##.95.107
- http://69.###.33.84:8080/GuPGeFau4RY via 69.##3.33.84
- DNS ASK vg##h.com
- '%HOMEPATH%\363.exe'
- '%WINDIR%\syswow64\driversend.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABHAGYAbwBjAG4AZgB1AHoAdABxAD0AJwBFAGQAbgBtAHcAbgBpAHAAaQBrACcAOwAkAE0AcAB0AGYAZgBhAGYAcwB1AHgAeQAgAD0AIAAnADMANgAzACcAOwAkAFEAcgByAHQAbQBrAGsAeABrAD0AJwBYAGcAcABlAGkAbwBzAHoAZgB...' (со скрытым окном)