Техническая информация
- [HKLM\SYSTEM\CurrentControlSet\Services\wanarp] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\RasMan] 'Start' = '00000002'
- <SYSTEM32>\rasphone.exe
- %ALLUSERSPROFILE%\systemcertificates\5907d36c6c3abc15\a.exe
- C:\users\public\42da01f7bd713b86.cmp
- C:\users\public\42da01f7bd713b86.cms
- C:\users\public\42da01f7bd713b86.pbk
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
- DNS ASK ww##s.lol
- '%ALLUSERSPROFILE%\systemcertificates\5907d36c6c3abc15\a.exe'
- '<SYSTEM32>\rasphone.exe' -f "C:\Users\Public\42DA01F7BD713B86.pbk" -d "PoCEntry"
- '<SYSTEM32>\cmd.exe' /c start "" "%ALLUSERSPROFILE%\SystemCertificates\5907d36c6c3abc15\a.exe"