Техническая информация
- <SYSTEM32>\wbem\scrcons.exe -Embedding
- <SYSTEM32>\cscript.exe /nologo "%TEMP%\\~temp.vbs"
- <SYSTEM32>\cscript.exe ""%TEMP%\temp.vbs""
- %TEMP%\temp.vbs
- %TEMP%\~temp.vbs
- <Текущая директория>\???E23Ae¶E·µ?A?I?OO?Au??.doc
- %TEMP%\15.exe
- %TEMP%\15.exe
- %TEMP%\~temp.vbs
- %TEMP%\temp.vbs
- 'ch#####brain.shop.co':80
- 'localhost':1037
- ch#####brain.shop.co/count/count.php?m=########################################
- DNS ASK ch#####brain.shop.co
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''