Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\vvvvv.vbs
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" "aspnet_compiler.exe" ENABLE
- %WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe
- %TEMP%\xxxx.ps1
- 'mi#####ft.myiphost.com':6060
- DNS ASK mi#####ft.myiphost.com
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "%TEMP%\xxxx.ps1"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "%TEMP%\xxxx.ps1"' (со скрытым окном)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe" "aspnet_compiler.exe" ENABLE' (со скрытым окном)
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vvvvv.vbs"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe'