Техническая информация
- '<SYSTEM32>\taskkill.exe' /f /im OfficeCookies.exe
- %TEMP%\7ZipSfx.000\31765.cmd
- %TEMP%\7ZipSfx.000\enc_Cooks.dll
- %TEMP%\7ZipSfx.000\CooksERR.dll
- %TEMP%\7ZipSfx.000\cr.dll
- %TEMP%\7ZipSfx.000\dec_enc_Cooks.dll
- %HOMEPATH%\OfficeCookies.exe
- %TEMP%\7ZipSfx.000\Document Microsoft Office.docx
- %TEMP%\7ZipSfx.001\9469.cmd
- %TEMP%\7ZipSfx.001\MicrosoftCookies.exe
- %TEMP%\7ZipSfx.000\cr.dll в %TEMP%\7ZipSfx.000\cr.exe
- %TEMP%\7ZipSfx.000\CooksERR.dll в %TEMP%\7ZipSfx.000\OfficeCookies.lnk
- ClassName: '' WindowName: ''
- '%TEMP%\7ZipSfx.000\cr.exe' "enc_Cooks.dll" dec "blbntdgbplerfhfgepbrb"
- '%HOMEPATH%\OfficeCookies.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\31765.cmd" "
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\7ZipSfx.000\Document Microsoft Office.docx
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.001\9469.cmd" "
- '<SYSTEM32>\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
- '<SYSTEM32>\reg.exe' Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '<SYSTEM32>\find.exe' /I "ProxyServer"