Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'NScqkXrIa' = 'rundll32.exe pcwutl.dll,LaunchApplication %HOMEPATH%\Links\gKN.vbs'
- %HOMEPATH%\links\links.ps1
- %HOMEPATH%\links\gkn.vbs
- 'ca####tokens.com':80
- http://ca####tokens.com/tags/traffic/images/azp6ai8pg5aq0c619ur0qzi6h/post.jsp
- DNS ASK ca####tokens.com