Техническая информация
- <SYSTEM32>\dialer.exe
- %TEMP%\miner_debug.txt
- %TEMP%\xig6rhqr2ekd.sys
- 'pa###bin.com':443
- 'po##.#ashvault.pro':443
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- DNS ASK po##.#ashvault.pro
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAd...
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart