Техническая информация
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\wwahost.exe
- %WINDIR%\syswow64\diskpart.exe
- Процесс iezo.exe, модуль Amsi.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
- 'wq###0476.com':80
- 'lo##.agency':80
- http://www.wq###0476.com/zzun/?eN##################################################################################
- http://www.lo##.agency/zzun/?eN##################################################################################
- DNS ASK wq###0476.com
- DNS ASK se#####id6793-chase.com
- DNS ASK el####troast.com
- DNS ASK nu###oken.site
- DNS ASK hf##56.com
- DNS ASK ke###-nava.xyz
- DNS ASK ve#####ations-uber.ca
- DNS ASK ba###sras.com
- DNS ASK lo##.agency
- DNS ASK qt###jwddup.xyz
- DNS ASK ne###enran.xyz
- DNS ASK he######ercerfineart.com
- DNS ASK si#####ogacenter.com
- DNS ASK ge###sys.com
- '%WINDIR%\syswow64\diskpart.exe'
- '%WINDIR%\syswow64\wwahost.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\SysWOW64\diskpart.exe"