Техническая информация
- %TEMP%\inzector_protected.exe
- %TEMP%\wservices.exe
- 'pa###bin.com':443
- 'pk#.goog':80
- '19#.#61.193.99':21153
- http://pk#.goog/gsr1/gsr1.crt
- 'pa###bin.com':443
- '19#.#61.193.99':21153
- DNS ASK pa###bin.com
- DNS ASK pk#.goog
- '%TEMP%\inzector_protected.exe'
- '%TEMP%\wservices.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGYAegBxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAZQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA... (со скрытым окном)