Техническая информация
- 'nsi' "%WINDIR%\SysWOW64\cscapi\nsi.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHMAZwA2AGgANwA3AD0AWwBjAGgAYQByAF0ANAAyADsAJABKAGcAMwB2AG8ANQA3AD0AKAAoACcAUQBtACcAKwAnAGMAJwApACsAJwBwAGkAJwArACcANQB5ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQ...
- %HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe
- %WINDIR%\syswow64\cscapi\nsi.exe
- %HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe в %WINDIR%\syswow64\cscapi\nsi.exe
- '42.##0.96.63':80
- http://co###rse.com.ar/colfar/A/
- http://42.##0.96.63/x4Cp7ciUk0L1L3dz/
- DNS ASK tr####ersuvan.com
- DNS ASK co###rse.com.ar
- '%HOMEPATH%\tceqbwm\dcxwgck\u9pruuf.exe'
- '%WINDIR%\syswow64\cscapi\nsi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHMAZwA2AGgANwA3AD0AWwBjAGgAYQByAF0ANAAyADsAJABKAGcAMwB2AG8ANQA3AD0AKAAoACcAUQBtACcAKwAnAGMAJwApACsAJwBwAGkAJwArACcANQB5ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQ...' (со скрытым окном)