Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pwrshplugin] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pwrshplugin] 'ImagePath' = '"%WINDIR%\SysWOW64\hlink\pwrshplugin.exe"'
- 'pwrshplugin' "%WINDIR%\SysWOW64\hlink\pwrshplugin.exe"
- 'pwrshplugin' %WINDIR%\SysWOW64\hlink\pwrshplugin.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -ENCOD IAAkAG8AaABGAD0AWwB0AFkAcABFAF0AKAAiAHsAMQB9AHsAMAB9AHsANAB9AHsAMgB9AHsAMwB9ACIAIAAtAEYAJwBzACcALAAnAFMAWQAnACwAJwBlAE0ALgBpAE8ALgBEAEkAcgBlAEMAVABPAC...
- %HOMEPATH%\djl8wko\ia2zjin\lu7c99t.exe
- %WINDIR%\syswow64\hlink\pwrshplugin.exe
- %HOMEPATH%\djl8wko\ia2zjin\lu7c99t.exe в %WINDIR%\syswow64\hlink\pwrshplugin.exe
- '19#.#02.229.74':80
- http://in###hngoc.com/wp-admin/K/
- http://www.an###thinh.com/autotoxication/96F/
- http://19#.#02.229.74/4gEgz/Xcjl6d3Aex1Fse4Wn/SrxfToH/pPO5K2woIFg3AzS/
- DNS ASK in###hngoc.com
- DNS ASK an###thinh.com
- '%HOMEPATH%\djl8wko\ia2zjin\lu7c99t.exe'
- '%WINDIR%\syswow64\hlink\pwrshplugin.exe'