Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msi] 'ImagePath' = '"%WINDIR%\SysWOW64\msi\msi.exe"'
- 'msi' "%WINDIR%\SysWOW64\msi\msi.exe"
- 'msi' %WINDIR%\SysWOW64\msi\msi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB6AG8AZAB0AGgAZQBhAHcAPQAnAG0AYQBpAGcAbQBvAGoAYwBvAG8AYwBwAG8AbwB3AHYAaQBlAGMAdABoAGEAbwByACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAGAAQwB1AF...
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %HOMEPATH%\573.exe
- %WINDIR%\syswow64\msi\msi.exe
- %HOMEPATH%\573.exe в %WINDIR%\syswow64\msi\msi.exe
- '20#.#12.78.182':80
- '74.##7.230.187':8080
- http://74.###.230.187:8080/XXJFKWjnisG2/HlHC6qYNOtoAe/tnu7frHCsUAHZ/ via 74.##7.230.187
- DNS ASK kd###umy.com
- DNS ASK lw##y.com
- '%HOMEPATH%\573.exe'
- '%WINDIR%\syswow64\msi\msi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB6AG8AZAB0AGgAZQBhAHcAPQAnAG0AYQBpAGcAbQBvAGoAYwBvAG8AYwBwAG8AbwB3AHYAaQBlAGMAdABoAGEAbwByACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAGAAQwB1AF...' (со скрытым окном)